Cryptographic processing system, key generation device, encryption device, decryption device, key delegation device, cryptographic processing method, and cryptographic processing program

ABSTRACT

Hierarchical predicate encryption (HPE) for inner products with enhanced efficiency of operations. A cryptographic processing system includes a key generation device, an encryption device, and a decryption device. The key generation device generates, as a decryption key sk L , a vector in which predicate information v{right arrow over ( )} t  is embedded in a basis vector of a basis B* t  for each integer t of t=1, . . . , L. The encryption device generates, as a ciphertext ct, a vector in which attribute information x{right arrow over ( )} t  is embedded in a basis vector of a basis B t  for at least some integer t of t=1, . . . , L. The decryption device performs a pairing operation on the decryption key sk L  generated by the key generation device and the ciphertext ct generated by the encryption device, and decrypts the ciphertext ct.

TECHNICAL FIELD

The present invention relates to hierarchical predicate encryption(HPE).

BACKGROUND ART

Non-Patent Literature 21 discusses HPE for inner products. Non-PatentLiterature 18 discusses functional encryption.

CITATION LIST Non-Patent Literature

-   Non-Patent Literature 1: Beimel, A., Secure schemes for secret    sharing and key distribution. PhD Thesis, Israel Institute of    Technology, Technion, Haifa, Israel, 1996.-   Non-Patent Literature 2: Bethencourt, J., Sahai, A., Waters, B.:    Ciphertext-policy attribute-based encryption. In:2007 IEEE Symposium    on Security and Privacy, pp. 321•34. IEEE Press (2007)-   Non-Patent Literature 3: Boneh, D., Boyen, X.: Efficient    selective-ID secure identity based encryption without random    oracles. In: Cachin, C., Camenisch, J. (eds.) EUROCRYPT 2004. LNCS,    vol. 3027, pp. 223•38. Springer Heidelberg (2004)-   Non-Patent Literature 4: Boneh, D., Boyen, X.: Secure identity based    encryption without random oracles. In:Franklin, M. K. (ed.)    CRYPTO 2004. LNCS, vol. 3152, pp. 443•59. Springer Heidelberg (2004)-   Non-Patent Literature 5: Boneh, D., Boyen, X., Goh, E.: Hierarchical    identity based encryption with constant size ciphertext. In:    Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 440•56.    Springer Heidelberg (2005)-   Non-Patent Literature 6: Boneh, D., Franklin, M.: Identity-based    encryption from the Weil pairing. In: Kilian, J. (ed.) CRYPTO 2001.    LNCS, vol. 2139, pp. 213•29. Springer Heidelberg (2001)-   Non-Patent Literature 7: Boneh, D., Hamburg, M.: Generalized    identity based and broadcast encryption scheme. In:Pieprzyk, J.    (ed.) ASIACRYPT 2008. LNCS, vol. 5350, pp. 455•70. Springer    Heidelberg (2008)-   Non-Patent Literature 8: Boneh, D., Katz, J., Improved efficiency    for CCA-secure cryptosystems built using identity based encryption.    RSA-CT 2005, LNCS, Springer Verlag (2005)-   Non-Patent Literature 9: Boneh, D., Waters, B.: Conjunctive, subset,    and range queries on encrypted data. In:Vadhan, S. P. (ed.) TCC    2007. LNCS, vol. 4392, pp. 535•54. Springer Heidelberg (2007)-   Non-Patent Literature 10: Boyen, X., Waters, B.: Anonymous    hierarchical identity-based encryption (without random oracles). In:    Dwork, C. (ed.) CRYPTO 2006. LNCS, vol. 4117, pp. 290•07. Springer    Heidelberg (2006)-   Non-Patent Literature 11: Canetti, R., Halevi S., Katz J.:    Chosen-ciphertext security from identity-based encryption. EUROCRYPT    2004, LNCS, Springer-Verlag (2004)-   Non-Patent Literature 12: Cocks, C.: An identity based encryption    scheme based on quadratic residues. In: Honary, B. (ed.) IMA Int.    Conf. LNCS, vol. 2260, pp. 360•63. Springer Heidelberg (2001)-   Non-Patent Literature 13: Gentry, C.: Practical identity-based    encryption without random oracles. In: Vaudenay, S. (ed.)    EUROCRYPT 2006. LNCS, vol. 4004, pp. 445•64. Springer Heidelberg    (2006)-   Non-Patent Literature 14: Gentry, C., Halevi, S.: Hierarchical    identity-based encryption with polynomially many levels. In:    Reingold, O. (ed.) TCC 2009. LNCS, vol. 5444, pp. 437•56. Springer    Heidelberg (2009)-   Non-Patent Literature 15: Gentry, C., Silverberg, A.: Hierarchical    ID-based cryptography. In: Zheng, Y. (ed.) ASIACRYPT 2002. LNCS,    vol. 2501, pp. 548•66. Springer Heidelberg (2002)-   Non-Patent Literature 16: Goyal, V., Pandey, O., Sahai, A., Waters,    B.: Attribute-based encryption for fine-grained access control of    encrypted data. In: ACM Conference on Computer and Communication    Security 2006, pp. 89•8, ACM (2006)-   Non-Patent Literature 17: Katz, J., Sahai, A., Waters, B.: Predicate    encryption supporting disjunctions, polynomial equations, and inner    products. In: Smart, N. P. (ed.) EUROCRYPT 2008. LNCS, vol. 4965,    pp. 146•62. Springer Heidelberg (2008)-   Non-Patent Literature 18: Lewko, A., Okamoto, T., Sahai, A.,    Takashima, K., Waters, B.: Fully secure functional encryption:    Attribute-based encryption and (hierarchical) inner product    encryption, EUROCRYPT 2010. LNCS, Springer Heidelberg (2010)-   Non-Patent Literature 19: Lewko, A. B., Waters, B.: New techniques    for dual system encryption and fully secure HIBE with short    ciphertexts. In: Micciancio, D. (ed.) TCC 2010. LNCS, vol. 5978, pp.    455•79. Springer Heidelberg (2010)-   Non-Patent Literature 20: Okamoto, T., Takashima, K.: Homomorphic    encryption and signatures from vector decomposition. In:    Galbraith, S. D., Paterson, K. G. (eds.) Pairing 2008. LNCS, vol.    5209, pp. 57•4. Springer Heidelberg (2008)-   Non-Patent Literature 21: Okamoto, T., Takashima, K.: Hierarchical    predicate encryption for inner-products, In:ASIACRYPT 2009, Springer    Heidelberg (2009)-   Non-Patent Literature 22: Ostrovsky, R., Sahai, A., Waters, B.:    Attribute-based encryption with non-monotonic access structures. In:    ACM Conference on Computer and Communication Security 2007, pp.    195•03, ACM (2007)-   Non-Patent Literature 23: Pirretti, M., Traynor, P., McDaniel, P.,    Waters, B.: Secure attribute-based systems. In: ACM Conference on    Computer and Communication Security 2006, pp. 99•12, ACM, (2006)-   Non-Patent Literature 24: Sahai, A., Waters, B.: Fuzzy    identity-based encryption. In: Cramer, R. (ed.) EUROCRYPT 2005.    LNCS, vol. 494, pp. 457•73. Springer Heidelberg (2005)-   Non-Patent Literature 25: Shi, E., Waters, B.: Delegating capability    in predicate encryption systems. In: Aceto, L., Damgaard, I.,    Goldberg, L. A., Halldorsson, M. M., Ingolfsdottir, A.,    Walukiewicz, I. (eds.) ICALP (2) 2008. LNCS, vol. 5126, pp. 560.578.    Springer Heidelberg (2008)-   Non-Patent Literature 26: Waters, B.: Efficient identity based    encryption without random oracles. Eurocrypt 2005, LNCS, vol. 3152,    pp. 443•59. Springer Verlag, (2005)-   Non-Patent Literature 27: Waters, B.: Ciphertext-policy    attribute-based encryption: an expressive, efficient, and provably    secure realization. ePrint, IACR, http://eprint.iacr.org/2008/290-   Non-Patent Literature 28: Waters, B.: Dual system encryption:    realizing fully secure IBE and HIBE under simple assumptions. In:    Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 619˜36. Springer    Heidelberg (2009)

DISCLOSURE OF INVENTION Technical Problem

In an HPE scheme for inner products discussed in Non-Patent Literature21, cryptographic processes are constructed using one large space. Thus,when this HPE scheme for inner products is implemented, key sizes couldbe large, adversely affecting efficiency of operations and so on.

It is an object of the present invention to provide an HPE scheme forinner products with enhanced efficiency of operations and so on.

Solution to Problem

A cryptographic processing system according to this invention is acryptographic processing system that performs a cryptographic processusing a basis B_(t) and a basis B*_(t) for each integer t of t=1, . . ., L+1 (L being an integer of 1 or more), the cryptographic processingsystem, and includes

an encryption device that generates, as a ciphertext et, a vector inwhich attribute information x{right arrow over ( )}_(t) is embedded in abasis vector of the basis B_(t) for at least some integer t of t=1, . .. , L;

a decryption device that uses, as a decryption key sk_(L), a vector inwhich predicate information v{right arrow over ( )}_(t) is embedded in abasis vector of the basis B*_(t) for each integer t of t=1, . . . , L,performs a pairing operation on the ciphertext ct generated by theencryption device and the decryption key sk_(L), and decrypts theciphertext ct; and

a key delegation device that generates a lower-level decryption keysk_(L+1) of the decryption key sk_(L), based on a vector in whichpredicate information v{right arrow over ( )}_(L+1) is embedded in abasis vector of a basis B*_(L+1) and the decryption key sk_(L) used bythe decryption device.

Advantageous Effects of Invention

In a cryptographic processing system according to the present invention,a hierarchical structure is constructed using a plurality of spaces.Thus, key sizes can be made small, thereby enhancing efficiency ofoperations.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a diagram for explaining a notion of “delegation (hierarchicaldelegation)”;

FIG. 2 is a diagram for explaining delegation skipping over a level;

FIG. 3 is a diagram showing hierarchical structures of attributeinformation and predicate information;

FIG. 4 is a diagram showing an example of hierarchical identity-basedencryption;

FIG. 5 is a diagram for explaining a basis and a basis vector;

FIG. 6 is a diagram for explaining an example of a method forimplementing a hierarchical structure in vector spaces;

FIG. 7 is a configuration diagram of a cryptographic processing system10 that executes algorithms of an HPE scheme for inner products.

FIG. 8 is a functional block diagram showing functions of a keygeneration device 100;

FIG. 9 is a functional block diagram showing functions of an encryptiondevice 200;

FIG. 10 is functional block diagram showing functions of a decryptiondevice 300;

FIG. 11 is a functional block diagram showing functions of a keydelegation device 400;

FIG. 12 is a flowchart showing a process of a Setup algorithm;

FIG. 13 is a flowchart showing a process of a KeyGen algorithm;

FIG. 14 is a flowchart showing a process of an Enc algorithm;

FIG. 15 is a flowchart showing a process of a Dec algorithm;

FIG. 16 is a flowchart showing a process of a Delegate_(L) algorithm;

FIG. 17 is a flowchart showing a process of a KeyGen algorithm;

FIG. 18 is a flowchart showing a process of the Dec algorithm;

FIG. 19 is a flowchart showing a process of the Delegate_(L) algorithm;and

FIG. 20 is a diagram showing an example of a hardware configuration ofthe key generation device 100, the encryption device 200, and thedecryption device 300.

DESCRIPTION OF PREFERRED EMBODIMENTS

Embodiments of the invention will now be described with reference todrawings.

In the following description, a processing device is a CPU 911 or thelike to be described later. A storage device is a ROM 913, a RAM 914, amagnetic disk 920 or the like to be described later. A communicationdevice is a communication board 915 or the like to be described later.An input device is a keyboard 902, the communication board 915 or thelike to be described later. An output device is the RAM 914, themagnetic disk 920, the communication board 915, an LCD 901 or the liketo be described later. That is, the processing device, the storagedevice, the communication device, the input device, and the outputdevice are hardware.

Notations to be used in the following description will be described.

When A is a random variable or distribution, Formula 101 denotes that yis randomly selected from A according to the distribution of A. That is,y is a random number in Formula 101.

$\begin{matrix}{y\overset{R}{}A} & \left\lbrack {{Formula}\mspace{14mu} 101} \right\rbrack\end{matrix}$

When A is a set, Formula 102 denotes that y is uniformly selected fromA.

That is, y is a uniform random number in Formula 102.

$\begin{matrix}{y\overset{U}{}A} & \left\lbrack {{Formula}\mspace{14mu} 102} \right\rbrack\end{matrix}$

Formula 103 denotes that y is set, defined or substituted by z.

y:=z  [Formula 103]

When a is a fixed value, Formula 104 denotes that a machine (algorithm)A outputs a on an input x.

A(x)→a  [Formula 104]

for example,

A(x)→1

Formula 105, that is, F _(q), denotes a finite field of order q.

_(q)  [Formula 105]

A vector symbol denotes a vector representation over the finite fieldF_(q), that is, Formula 106.

{right arrow over (x)} denotes

(x ₁ , . . . , x _(n))ε

_(q).  [Formula 106]

Formula 107 denotes the inner product, shown in Formula 109, of twovectors x{right arrow over ( )} and v{right arrow over ( )} shown inFormula 108.

{right arrow over (x)}·{right arrow over (v)}  [Formula 107]

{right arrow over (x)}=(x ₁ , . . . , x _(n)),

{right arrow over (v)}=(v ₁ , . . . , v _(n))  [Formula 108]

Σ_(i=1) ^(n) x _(i) v _(i)  [Formula 109]

X^(T) denotes the transpose of a matrix X.

For a basis B and a basis B* shown in Formula 110, Formula 111 isdefined.

:=(b ₁ , . . . , b _(N)),

*:=(b* ₁ , . . . , b* _(N))  [Formula 110]

(X ₁ , . . . , x _(N)

:=Σ_(i=1) ^(N) x _(i) b _(i),

(y ₁ , . . . , y _(N)

:=Σ_(i=1) ^(N) y _(i) b _(i)*  [Formula 111]

e{right arrow over ( )}_(t,j) denotes an orthonormal basis vector shownin Formula 112.

$\begin{matrix}{{{{\overset{\rightarrow}{e}}_{t,j}\text{:}\mspace{11mu} \overset{\overset{j - 1}{}}{\left( {0\mspace{14mu} \ldots \mspace{14mu} 0} \right.}},1,{\overset{\overset{n_{t} - j}{}}{\left. {0\mspace{14mu} \ldots \mspace{14mu} 0} \right)}\varepsilon \mspace{11mu} _{q}^{n_{t}}}}{for}{{j = 1},\ldots \mspace{11mu},n_{t}}} & \left\lbrack {{Formula}\mspace{14mu} 112} \right\rbrack\end{matrix}$

Formula 113 to Formula 117 are defined.

$\begin{matrix}{{\left( {\left( {\overset{\rightarrow}{x}}_{0} \right)_{_{0}^{*}},\ldots \mspace{11mu},\left( {\overset{\rightarrow}{x}}_{d} \right)_{_{d}^{*}}} \right) + \left( {\left( {\overset{\rightarrow}{y}}_{0} \right)_{_{0}^{*}},\ldots \mspace{11mu},\left( {\overset{\rightarrow}{y}}_{d} \right)_{_{d}^{*}}} \right)}:=\left( {\left( {{\overset{\rightarrow}{x}}_{0} + {\overset{\rightarrow}{y}}_{0}} \right)_{_{0}^{*}},\ldots \mspace{11mu},\left( {{\overset{\rightarrow}{x}}_{d} + {\overset{\rightarrow}{y}}_{d}} \right)_{_{d}^{*}}} \right)} & \left\lbrack {{Formula}\mspace{14mu} 113} \right\rbrack \\{(x)_{_{t}^{*}}:=\left( {\left( \overset{\rightarrow}{0} \right)_{_{0}^{*}},\ldots \mspace{11mu},\left( \overset{\rightarrow}{0} \right)_{_{t - 1}^{*}},\left( \overset{\rightarrow}{x} \right)_{_{t}^{*}},\left( \overset{\rightarrow}{0} \right)_{_{t + 1}^{*}},\ldots \mspace{11mu},\left( \overset{\rightarrow}{0} \right)_{_{d}^{*}}} \right)} & \left\lbrack {{Formula}\mspace{14mu} 114} \right\rbrack \\{\mspace{79mu} {\left( {\left( {\overset{\rightarrow}{x}}_{i} \right)_{_{i}^{*}},\left( {\overset{\rightarrow}{x}}_{j} \right)_{_{j}^{*}}} \right):=\left( {\left( {\overset{\rightarrow}{x}}_{i} \right)_{_{i}^{*}} + \left( {\overset{\rightarrow}{x}}_{j} \right)_{_{j}^{*}}} \right.}} & \left\lbrack {{Formula}\mspace{14mu} 115} \right\rbrack \\{\left( {\left( {\overset{\rightarrow}{x}}_{0} \right)_{_{0}^{*}},{\left( {\overset{\rightarrow}{x}}_{t} \right)_{_{t}^{*}};{t = 1}},{\ldots \mspace{11mu} L}} \right):=\left( {\left( {\overset{\rightarrow}{x}}_{0} \right)_{_{0}^{*}},\ldots \mspace{11mu},\left( {\overset{\rightarrow}{x}}_{L} \right)_{_{L}^{*}}} \right)} & \left\lbrack {{Formula}\mspace{14mu} 116} \right\rbrack \\{\mspace{79mu} {{{e\left( {c,k^{*}} \right)}:={\prod\limits_{t = 0}^{d}\; {e\left( {c_{t},k_{t}^{*}} \right)}}},\mspace{79mu} {{{where}\mspace{14mu} c}:=\left( {{c_{0}\varepsilon {\langle _{0}\rangle}},\ldots \mspace{11mu},{c_{d}\varepsilon {\langle _{d}\rangle}}} \right)},\mspace{79mu} {k^{*}:=\left( {{k_{L,0}^{*}\varepsilon {\langle _{0}^{*}\rangle}},\ldots \mspace{11mu},{k_{d}^{*}\varepsilon {\langle _{d}^{*}\rangle}}} \right)}}} & \left\lbrack {{Formula}\mspace{14mu} 117} \right\rbrack\end{matrix}$

For Formula 118, Formula 119 is defined.

k*:=(({right arrow over (x)} ₀

, . . . , ({right arrow over (x)} _(d)

)  [Formula 118]

[k*] ^(L):=(({right arrow over (x)} ₀

, . . . , ({right arrow over (x)} _(L)

, ({right arrow over (0)}

, . . . , ({right arrow over (0)}

),

[k*] _(L):=(({right arrow over (0)}

, . . . , ({right arrow over (0)}

,({right arrow over (x)} _(L+1)

, . . . , ({right arrow over (x)} _(d)

)  [Formula 119]

In the following description, nt in F_(q) ^(nt) denotes n_(t).

Likewise, (v→1, . . . , v→4) in a secret key sk_((v→1, . . . , v→L))denotes (v{right arrow over ( )}₁, . . . , v{right arrow over ( )}_(L)),and (v→1, . . . , v→L+1) in a secret key sk_((v→1, . . . , v→L+1))denotes (v{right arrow over ( )}₁, . . . , v{right arrow over ()}_(L+1)).

Likewise, when “δi,j” is shown as a superscript, this δi,j denotesδ_(i,j).

When “→” representing a vector is attached to a subscript orsuperscript, this “→” is attached as a superscript to the subscript orsuperscript.

In the following description, a cryptographic process includes anencryption process, a decryption process, a key generation process, anda key delegation process.

First Embodiment

In this embodiment, basic concepts for implementing “HPE for innerproducts” and constructions of “HPE for inner products” will bedescribed.

Firstly, a notion of HPE for inner products will be described. Todescribe the notion of HPE for inner products, a notion of “delegation”will be described first, together with a notion of “hierarchicaldelegation”. Then, “predicate encryption (PE) for inner products” willbe described. Then, “HPE for inner products”, which is a type of PE forinner products with the notion of hierarchical delegation, will bedescribed. Further, to reinforce the understanding of HPE for innerproducts, an application example of HPE for inner products will bedescribed.

Secondly, HPE for inner products in vector spaces will be described. Inthis and subsequent embodiments, HPE and hierarchical predicate keyencapsulation mechanism (HPKEM) are implemented in vector spaces. “Abasis” and “a basis vector” will be described first. Then, “PE for innerproducts in vector spaces” will be described. Then, “a method forimplementing a hierarchical structure in vector spaces” will bedescribed. Further, to reinforce the understanding, an implementationexample of the hierarchical structure will be described.

Thirdly, “dual pairing vector spaces (DPVS)” having rich mathematicalstructures for implementing HPE for inner products will be described.

Fourthly, basic constructions of “an HPE scheme for inner products”according to this embodiment will be described. Then, basicconstructions of “a cryptographic processing system 10” that implementsHPE will be described. Then, the HPE scheme and the cryptographicprocessing system 10 according to this embodiment will be described indetail.

<1. HPE for Inner Products>

<1-1. Notion of Delegation (Hierarchical Delegation)>

FIG. 1 is a diagram for explaining the notion of “delegation(hierarchical delegation)”.

Delegation means that a user who has a higher-level key generates alower-level key having more limited capabilities than the user's(higher-level) key.

In FIG. 1, a root (key generation device) generates secret keys forfirst-level (level-1) users by using a master secret key. That is, theroot generates keys 1, 2, and 3 for first-level users 1, 2, and 3,respectively. Then, using the key 1, for example, the user 1 cangenerate keys 11, 12, and 13 for users 11, 12, and 13, respectively, whoare lower-level (second-level) users of the user 1. The keys 11, 12, and13 owned by the users 11, 12, and 13 have more limited capabilities thanthe key 1 owned by the user 1. The limited capabilities mean thatciphertexts that can be decrypted by that secret key are limited. Thatis, a lower-level secret key can only decrypt some of ciphertexts thatcan be decrypted by a higher-level secret key. This means that the keys11, 12, and 13 owned by the users 11, 12, and 13 can only decrypt someof ciphertexts that can be decrypted by the key 1 owned by the user 1.Generally, the keys 11, 12, and 13 can decrypt respectively differentciphertexts. On the other hand, a ciphertext that can be decrypted bythe keys 11, 12, or 13 can be decrypted by the key 1.

As shown in FIG. 1, each secret key is provided for a specific level.This is described as “hierarchical”. That is, as shown in FIG. 1,hierarchical generation of lower-level keys is called “hierarchicaldelegation”.

In FIG. 1, it has been described that the root generates the secret keysfor the first-level users, the first-level users generate the secretkeys for the second-level users, and the second-level users generate thesecret keys for the third-level users. However, as shown in FIG. 2, theroot can generate not only the secret keys for the first-level users,but also the secret keys for the second-level or lower-level users.Likewise, the first-level users can generate not only the secret keysfor the second-level users, but also the secret keys for the third-levelor lower-level users. That is, the root or each user can generate thesecret keys for levels lower than the level of its own secret key.

<1-2. PE for Inner Products>

Next, “PE for inner products” will be described.

PE is a cryptographic scheme in which a ciphertext can be decrypted if aresult of inputting attribute information x to predicate informationf_(v) is 1 (true) (f_(v)(x)=1). Generally, the attribute information xis embedded in a ciphertext, and the predicate information f_(v) isembedded in a secret key. That is, in PE, a ciphertext c encrypted basedon the attribute information x is decrypted by a secret key SK_(f)generated based on the predicate information f_(v). PE may be describedas a cryptographic scheme in which, for example, the predicateinformation f_(v) is a conditional expression and the attributeinformation x is information to be input to the conditional expression,and a ciphertext can be decrypted if the input information (attributeinformation x) satisfies the conditional expression (predicateinformation f_(v)) (f_(v)(x)=1).

PE is discussed in detail in Non-Patent Literature 17.

PE for inner products is a type of PE in which f_(v)(x)=1 if the innerproduct of attribute information x and predicate information f_(v) is apredetermined value. That is, a ciphertext c encrypted by the attributeinformation x can be decrypted by a secret key SK_(f) generated based onthe predicate information f_(v) if and only if the inner product of theattribute information x and the predicate information f_(v) is apredetermined value.

In the first embodiment, it is assumed as a general rule that f_(v)(x)=1if the inner product of the attribute information x and the predicateinformation f_(v) is 0.

<1-3. HPE for Inner Products>

HPE for inner products (HPKEM for inner products) is a type of “PE forinner products” with the above-described notion of “hierarchicaldelegation”.

In HPE for inner products, attribute information and predicateinformation have hierarchical structures, in order to incorporate ahierarchical delegation system in PE for inner products.

FIG. 3 is a diagram showing hierarchical structures of attributeinformation and predicate information.

In FIG. 3, attribute information and predicate information with the samereference numerals correspond to each other (i.e., their inner productis 0). That is, the inner product of an attribute 1 and a predicate 1 is0, the inner product of an attribute 11 and a predicate 11 is 0, theinner product of an attribute 12 and a predicate 12 is 0, and the innerproduct of an attribute 13 and a predicate 13 is 0. This means that aciphertext c1 encrypted by the attribute 1 can be decrypted by a secretkey k1 generated based on the predicate 1. A ciphertext c11 encrypted bythe attribute 11 can be decrypted by a secret key k11 generated based onthe predicate 11. The same can be said of the attribute 12 and thepredicate 12 as well as the attribute 13 and the predicate 13.

As described above, HPE for inner products has the hierarchicaldelegation system. Thus, the secret key k11 can be generated based onthe predicate 11 and the secret key k1 generated based on thepredicate 1. That is, a user having the higher-level secret key k1 cangenerate its lower-level secret key k11 from the secret key k1 and thelower-level predicate 11. Likewise, a secret key k12 can be generatedfrom the secret key k1 and the predicate 12, and a secret key k13 can begenerated from the secret key k1 and the predicate 13.

A ciphertext encrypted by a key (public key) corresponding to alower-level secret key can be decrypted by a higher-level secret key. Onthe other hand, a ciphertext encrypted by a key (public key)corresponding to a higher-level secret key cannot be decrypted by alower-level secret key. That is, the ciphertexts c11, c12, and c13encrypted by the attributes 11, 12, and 13, respectively, can bedecrypted by the secret key k1 generated based on the predicate 1. Onthe other hand, the ciphertext c1 encrypted by the attribute 1 cannot bedecrypted by the secret keys k11, k12, and k13 generated based on thepredicates 11, 12, and 13, respectively. That is, the inner product ofthe attribute 11, 12, or 13 and the predicate 1 is 0. On the other hand,the inner product of the attribute 1 and the predicate 11, 12, or 13 isnot 0.

<1-4. Application Example of HPE for Inner Products>

FIG. 4 is a diagram showing an example of hierarchical identity-basedencryption (HIBE), which is an application example of the HPE scheme forinner products to be described later. HIBE is a cryptographic process inwhich the notion of hierarchical is applied to identity-based encryption(IBE). IBE is a type of PE, namely, matching PE, which allows aciphertext to be decrypted if an ID included in the ciphertext matchesan ID included in a secret key.

In the example shown in FIG. 4, based on a master secret key sk and anID “A” of Company A, a root (key generation device) generates a secretkey (key A) corresponding to the ID “A”. For example, based on the key Aand the ID of each division, a security administrator of Company Agenerates a secret key corresponding to that ID. For example, thesecurity administrator generates a secret key (key 1) corresponding toan ID “A-1” of a sales division. Then, based on the secret key of eachdivision and the ID of each unit belonging to that division, forexample, an administrator of each division generates a secret keycorresponding to that ID. For example, an administrator of the salesdivision generates a secret key (key 11) corresponding to an ID “A-11”of a sales unit 1.

In this case, a ciphertext encrypted by the ID “A-11” of the sales unit1 can be decrypted by the key 11 which is the secret key correspondingto the ID “A-11” of the sales unit 1. However, a ciphertext encrypted bythe ID of a sales unit 2 or a sales unit 3 cannot be decrypted by thekey 11. Also, a ciphertext encrypted by the ID of the sales divisioncannot be decrypted by the key 11.

A ciphertext encrypted by the ID “A-1” of the sales division can bedecrypted by the key 1 which is the secret key corresponding to the ID“A-1” of the sales division. Also, a ciphertext encrypted by the ID of aunit belonging to the sales division can be decrypted by the key 1. Thatis, a ciphertext encrypted by the ID of the sales unit 1, 2, or 3 can bedecrypted by the key 1. However, a ciphertext encrypted by the ID of amanufacturing division (ID: A-2) or a staff division (ID: A-3) cannot bedecrypted by the key 1. Also, a ciphertext encrypted by the ID ofCompany A cannot be decrypted by the key 1.

A ciphertext encrypted by the ID “A” of Company A can be decrypted bythe key A which is the secret key corresponding to the ID “A” of CompanyA. Also, a ciphertext encrypted by the ID of each division belonging toCompany A or the ID of a unit belonging to each division can bedecrypted by the key A.

HPE for inner products can be adapted to various applications other thanIBE. In particular, cryptographic processes to be described later arenot limited to a class of equality tests, so that they can be applied toa vast number of applications. For example, with respect to searchableencryption or the like which is a type of PE for inner products, thecryptographic processes allow applications that cannot be implementedwith conventional PE having the delegation system, such as limiting asearchable range at each level by using a conditional expression such asAND or OR.

That is, the HPKEM and HPE schemes to be described in the subsequentembodiments can be applied to a wide variety of applications such as IBEand searchable encryption.

<2. HPE for Inner Products in Vector Spaces>

HPKEM and HPE are implemented in high-dimensional vector spaces calleddual pairing vector spaces (DPVS) to be described later. Thus, HPE forinner products in vector spaces will be described.

<2-1. Basis and Basis Vector>

First, “a basis” and “a basis vector” to be used for explaining a vectorspace will be briefly explained.

FIG. 5 is a diagram for explaining the basis and the basis vector.

FIG. 5 shows a vector v of a 2-dimensional vector space. The vector v isc₁a₁+c₂a₂. Further, the vector v is y₁b₁+y₂b₂. Here, a₁ and a₂ arecalled basis vectors in a basis A, and are represented as basis A:=(a₁,a₂). b₁ and b₂ are called basis vectors in a basis B, and arerepresented as basis B:=(b₁, b₂). c₁, c₂, y₁, and y₂ are coefficients ofrespective basis vectors. FIG. 5 shows a 2-dimensional vector space, sothat there are two basis vectors in each basis. In an N-dimensionalvector space, there are an N number of basis vectors in each basis.

<2-2. PE for Inner Products in Vector Spaces>

PE for inner products in vector spaces will now be described.

As described above, PE for inner products is a type of PE in whichf_(v)(x)=1 if the inner product of the attribute information x and thepredicate information f_(v) is a predetermined value (0 in this case).When the attribute information x and the predicate information f_(v) arevectors, namely, an attribute vector x{right arrow over ( )} and apredicate vector v{right arrow over ( )}, their inner-product predicateis defined as shown in Formula 120.

If {right arrow over (x)}·{right arrow over (v)}=Σ _(i=1) ^(n) x _(i) v_(i)=0, then f _({right arrow over (v)})({right arrow over (x)})=1, and

if {right arrow over (x)}·{right arrow over (v)}=Σ _(i=1) ^(n) x _(i) v_(i)≠0, then f _({right arrow over (v)})({right arrow over(x)})=0,  [Formula 120]

where{right arrow over (x)}=(x₁, . . . , x_(n)),{right arrow over (v)}=(v₁, . . . , v_(n)),

That is, it is a type of PE in which a result of inputting the attributeinformation x to the predicate information f_(v) is 1 (true) if theinner product of the attribute vector x{right arrow over ( )} and thepredicate vector {right arrow over (v)} (i.e., the sum of element-wiseinner products) is 0, and a result of inputting the attributeinformation x to the predicate information f_(v) is 0 (false) if theinner product of the attribute vector x{right arrow over ( )} and thepredicate vector v{right arrow over ( )} is not 0.

<2-3. Method for Implementing a Hierarchical Structure in Vector Spaces>

A method for implementing a hierarchical structure in vector spaces willnow be described.

FIG. 6 is a diagram for explaining an example of the method forimplementing a hierarchical structure in vector spaces.

A d number (d is an integer of 1 or more) of vector spaces will bediscussed here. Each vector space is a high-dimensional(N_(t)-dimensional (t=1, . . . , d)) vector space. That is, there existan N_(t) number of basis vectors c_(i) (i=1, . . . , N_(t)) in apredetermined basis C_(t) (t=1, . . . , d) in each vector space.

A basis C₁ is a space for setting attribute information and predicateinformation of a first level. A basis C₂ is a space for settingattribute information and predicate information of a second level.Likewise, a basis C_(L) is a space for setting attribute information andpredicate information of an L-th level. Thus, d levels can berepresented here.

A secret key of the L-th level is generated not only by setting thepredicate information of the L-th level using the basis C_(L), but alsoby setting the predicate information of the first to (L−1)-th levelsusing the bases C₁ to C_(L−1). That is, in a lower-level secret key, thepredicate information to be set in a higher-level secret key is alsoset. This arrangement allows the predicate information to have ahierarchical structure. Then, using the hierarchical structure of thepredicate information, a delegation system in PE for inner products isconstructed.

In the following description, a format of hierarchy n{right arrow over ()}:=(d; N₁, . . . , N_(d)) is used to denote the hierarchical structurein a vector space, where d is a value representing the depth of levelsdescribed above, and N_(i) (i=1, . . . , d) is a value representing thenumber of dimensions, that is, the number of basis vectors, allocated toeach level i.

<2-4. Implementation Example of the Hierarchical Structure>

The hierarchical structure will be explained using a simple example.Explanation will be given using an example where there are three levelsand each level is allocated a two-dimensional space. That is, n{rightarrow over ( )}:=(d; N₁, . . . , N_(d))=(3; 2, 2, 2).

A user who has a first-level secret key sk₁ generated based on afirst-level predicate vector v{right arrow over ( )}₁:=(v₁, v₂) cangenerate a second-level secret key sk₂ based on the first-level secretkey sk₁ and a second-level predicate vector v{right arrow over ()}₂:=(v₃, v₄). That is, the second-level secret key sk₂ is generatedbased on the predicate vectors (v{right arrow over ( )}₁, v{right arrowover ( )}₂). Likewise, a user who has the second-level secret key sk₂can generate a third-level secret key sk₃ based on the second-levelsecret key sk₂ and a third-level predicate vector v{right arrow over ()}₃=(v₅, v₆). That is, the third-level secret key sk₃ is generated basedon the predicate vectors (v{right arrow over ( )}₁, v{right arrow over ()}₂, v{right arrow over ( )}₃).

The first-level secret key sk₁ generated based on the first-levelpredicate vector v{right arrow over ( )}₁ is a secret key generated by(v{right arrow over ( )}₁, (0, 0), (0, 0)). Thus, the first-level secretkey sk₁ can decrypt a ciphertext encrypted by an attribute vector(x{right arrow over ( )}₁, (*, *), (*, *)):=((x₁, x₂), (*, *), (*, *))if v{right arrow over ( )}₁·x{right arrow over ( )}₁=0. This is because(*, *) (0, 0)=0. Here, “*” denotes an arbitrary value.

Likewise, the second-level secret key sk₂ generated based on thesecond-level predicate vectors (v{right arrow over ( )}₁, v{right arrowover ( )}₂) is a secret key generated by (v{right arrow over ( )}₁,v{right arrow over ( )}₂, (0, 0)). Thus, the second-level secret key sk₂can decrypt a ciphertext encrypted by attribute vectors (x{right arrowover ( )}₁, x{right arrow over ( )}₂, (*, *))=((x₁, x₂), (x₃, x₄), (*,*)) if v{right arrow over ( )}₁·x{right arrow over ( )}₁=0 and v{rightarrow over ( )}₂·x{right arrow over ( )}₂=0.

However, the second-level secret key sk₂ cannot decrypt a ciphertextencrypted by the first-level attribute vector x{right arrow over ()}₁:=(x₁, x₂) (i.e., (x{right arrow over ( )}₁, (*, *), (*, *)). This isbecause if not v{right arrow over ( )}₂=(0, 0), then (*, *)·v{rightarrow over ( )}₂≠0 and v{right arrow over ( )}₂·x{right arrow over ()}₂≠0. Therefore, it can be stated that the second-level secret key sk₂has more limited capabilities than the parent secret key key sk₂.

<3. Dual Pairing Vector Spaces (DPVS)>

Symmetric bilinear pairing groups will be described first.

Symmetric bilinear pairing groups (q, G, G^(T), g, e) are a tuple of aprime q, a cyclic additive group G of order q, a cyclic multiplicativegroup G^(T) of order q, g≠0εG, and a polynomial-time computablenondegenerate bilinear pairing e: G×G→G_(T). The nondegenerate bilinearpairing is e(sg, tg)=e(g, g)^(st) and e(g,g)≠1.

In the following description, Formula 121 is an algorithm that takes1_(λ) as input and outputs values of parameter param_(G):=(q, G, G_(T),g, e) of bilinear pairing groups with a security parameter λ.

G _(bpg)  [Formula 121]

Dual pairing vector spaces will now be described.

Dual pairing vector spaces (q, V, G_(T), A, e) can be constructed by adirect product of the symmetric bilinear pairing groups (param_(G):=(q,G, G_(T), g, e)). The dual pairing vector spaces (q, V, G_(T), A, e) area tuple of a prime q, an N-dimensional vector space V over F_(q) shownin Formula 122, a cyclic group G_(T) of order q, and a canonical basisA:=(a₁, . . . , a_(N)) of the space V, and have the following operations(1) and (2). Here, a_(i) is as shown in Formula 123.

$\begin{matrix}{:=\overset{\overset{N}{}}{ \times \ldots \times }} & \left\lbrack {{Formula}\mspace{14mu} 122} \right\rbrack \\{a_{i}:=\left( {\overset{\overset{i - 1}{}}{0,\ldots \mspace{11mu},0},g,\overset{\overset{N - i}{}}{0,\ldots \mspace{11mu},0}} \right)} & \left\lbrack {{Formula}\mspace{14mu} 123} \right\rbrack\end{matrix}$

Operation (1): Nondegenerate Bilinear Pairing

A pairing in the space V is defined by Formula 124.

e(x,y):=Π_(i=1) ^(N) e(G _(i) ,H _(i))ε

_(T)  [Formula 124]

where(G₁, . . . , G_(N)):=xε

(H₁, . . . , H_(N)):=yε

This is nondegenerate bilinear, that is, e(sx, ty)=e(x, y)^(st) and ife(x, y)=1 for all yεV, then x=0. For all i and j, e(a_(i), a_(j))=e(g,g)^(δi,j), where δ_(i,j)=1 if i=j, and δ_(i,j)=0 if i≠j, and e(g,g)≠1εG_(T).

Operation (2): Distortion Maps

Linear transformations φ_(i,j) on the space V shown in Formula 125 canachieve Formula 126.

$\begin{matrix}{{{{If}\mspace{14mu} {\varphi_{i,j}\left( a_{j} \right)}} = a_{i}}{and}{{k \neq j},{then}}{{\varphi_{i,j}\left( a_{k} \right)} = 0.}} & \left\lbrack {{Formula}\mspace{14mu} 125} \right\rbrack \\{{{\varphi_{i,j}(x)}:=\left( {\overset{\overset{i - 1}{}}{0,\ldots \mspace{11mu},0},g_{j},\overset{\overset{N - i}{}}{0,\ldots \mspace{11mu},0}} \right)}{{{where}\left( {g_{1},{\ldots \mspace{14mu} g_{N}}} \right)}:={x.}}} & \left\lbrack {{Formula}\mspace{14mu} 126} \right\rbrack\end{matrix}$

The linear transformations φ_(i,j) will be called distortion maps.

In the following description, Formula 127 is an algorithm that takes asinput 1^(λ) (λεnatural number), Nεnatural number, and values ofparameter param_(G):=(q, G, G_(T), g, e) of bilinear pairing groups, andoutputs values of parameter param_(v):=(q, V, G_(T), A, e) of dualpairing vector spaces with a security parameter λ and an N-dimensionalspace V.

G _(dpvs)  [Formula 127]

Description will be directed herein to a case where the dual pairingvector spaces are constructed using the above-described symmetricbilinear pairing groups. The dual pairing vector spaces can also beconstructed using asymmetric bilinear pairing groups. The followingdescription can easily be adapted to a case where the dual pairingvector spaces are constructed using asymmetric bilinear pairing groups.

<4. Construction of HPE and Cryptographic Processing System 10>

<4-1. Basic Construction of HPE for Inner Products>

A construction of the HPE scheme for inner products will be brieflydescribed.

The HPE scheme for inner products includes five probabilisticpolynomial-time algorithms: Setup, KeyGen, Enc, Dec, and Delegate_(L)(L=1, . . . , d−1).

(Setup)

The Setup algorithm takes as input a security parameter 1^(λ) and aformat of hierarchy n{right arrow over ( )}:=(d; N₀, . . . , N_(d)), andoutputs a master public key pk and a master secret key sk. The mastersecret key sk is a top-level key.

(KeyGen)

The KeyGen algorithm takes as input the master public key pk, the mastersecret key sk, and predicate vectors (v{right arrow over ( )}₁, v{rightarrow over ( )}_(L)) (1≦L≦d), and outputs an L-th-level secret keysk_((v→1, . . . , v→L)).

(Enc)

The Enc algorithm takes as input the master public key pk, attributevectors (x{right arrow over ( )}₁, . . . , x{right arrow over ( )}_(h))(1≦h≦d), and a message m, and outputs a ciphertext et (encrypted text).That is, the Enc algorithm outputs the ciphertext ct containing themessage m and encrypted by the attribute vectors (x{right arrow over ()}₁, . . . , x{right arrow over ( )}_(h)).

(Dec)

The Dec algorithm takes as input the master public key pk, theL-th-level secret key sk_((v→1, . . . , v→L)), and the ciphertext ct,and outputs the message m or a distinguished symbol ⊥. The distinguishedsymbol ⊥ is information indicating decryption failure. That is, the Decalgorithm decrypts the ciphertext ct by the L-th-level secret key, andextracts the message m. In case of decryption failure, the Dec algorithmoutputs the distinguished symbol ⊥.

(Delegate_(L))

Delegate_(L), takes as input the master public key pk, the L-th-levelsecret key sk_((v→1, . . . , v→L)), and an (L+1)-th-level predicatevector v{right arrow over ( )}_(L+1) (L+1≦d), and outputs an(L+1)-th-level secret key sk_((v→1, . . . , v→L+1)). That is, theDelegate_(L), algorithm outputs a lower-level secret key.

<4-2. Cryptographic Processing System 10>

The cryptographic processing system 10 that executes the algorithms ofthe HPE scheme for inner products will be described.

FIG. 7 is a configuration diagram of the cryptographic processing system10 that executes the algorithms of the HPE scheme for inner products.

The cryptographic processing system 10 includes a key generation device100, an encryption device 200, a decryption device 300, and a keydelegation device 400. Description will be given herein assuming thatthe decryption device 300 includes the key delegation device 400.However, the key delegation device 400 may be provided separately fromthe decryption device 300.

The key generation device 100 executes the Setup algorithm taking asinput a security parameter λ and a format of hierarchy n{right arrowover ( )}:=(d; N₀, . . . , N_(d)), and generates a master public key pkand a master secret key sk. Then, the key generation device 100 makespublic the generated master public key pk. The key generation device 100also executes the KeyGen algorithm taking as input the master public keypk, the master secret key sk, and predicate vectors (v{right arrow over( )}₁, . . . , v{right arrow over ( )}_(L)) (1≦L≦d), generates anL-th-level secret key sk_((v→1, . . . , v→L)), and secretly provides theL-th-level secret key to the L-th-level decryption device 300.

The encryption device 200 executes the Enc algorithm taking as input themaster public key pk, attribute vectors (x{right arrow over ( )}₁, . . ., x{right arrow over ( )}_(h)) (1≦h≦d), and a message m, and generates aciphertext ct. The encryption device 200 transmits the generatedciphertext ct to the decryption device 300.

The decryption device 300 executes the Dec algorithm taking as input themaster public key pk, the L-th-level secret key sk_((v→1, . . . , v→L)),and the ciphertext ct, and outputs the message m or the distinguishedsymbol ⊥.

The key delegation device 400 executes the Delegate_(L) algorithm takingas input the master public key pk, the L-th-level secret keysk_((v→1, . . . , v→L)), and an (L+1)-th-level predicate vector v{rightarrow over ( )}_(L+1) (L+1≦d), and generates an (L+1)-th-level secretkey sk_((v→1, . . . , v→L+1)), and secretly provides the (L+1)-th-levelsecret key to the (L+1)-th-level decryption device 300.

<4-3. Details of HPE Scheme for Inner Products and CryptographicProcessing System 10>

Referring to FIGS. 8 to 16, description will be directed to the HPEscheme for inner products according to the first embodiment. Descriptionwill also be directed to functions and operations of the cryptographicprocessing system 10 that implements the HPE scheme for inner products.

FIG. 8 is a functional block diagram showing functions of the keygeneration device 100. FIG. 9 is a functional block diagram showingfunctions of the encryption device 200. FIG. 10 is a functional blockdiagram showing functions of the decryption device 300. FIG. 11 is afunctional block diagram showing functions of the key delegation device400.

FIGS. 12 and 13 are flowcharts showing operations of the key generationdevice 100. FIG. 12 is a flowchart showing a process of the Setupalgorithm. FIG. 13 is a flowchart showing a process of the KeyGenalgorithm. FIG. 14 is a flowchart showing operations of the encryptiondevice 200 and showing a process of the Enc algorithm. FIG. 15 is aflowchart showing operations of the decryption device 300 and showing aprocess of the Dec algorithm. FIG. 16 is a flowchart showing operationsof the key delegation device 400 and showing a process of theDelegate_(L) algorithm.

In the following description, a subscript “dec” stands for “decryption”.The subscript “dec” indicates a decryption element used for decrypting aciphertext. A subscript “ran” stands for “randomization”. The subscript“ran” indicates a randomizing element for randomizing the coefficient ofa predetermined basis vector of a lower-level decryption key. Asubscript “del” stands for “delegation”. The subscript “del” indicates adelegation element for generating a lower-level decryption key.

The functions and operations of the key generation device 100 will bedescribed.

As shown in FIG. 8, the key generation device 100 includes a master keygeneration unit 110, a master key storage unit 120, an information inputunit 130 (first information input unit), a decryption key generationunit 140, and a key distribution unit 150 (decryption key transmissionunit).

The decryption key generation unit 140 includes a random numbergeneration unit 141, a decryption element generation unit 142, arandomizing element generation unit 143, and a delegation elementgeneration unit 144.

Referring to FIG. 12, the process of the Setup algorithm will bedescribed first.

(S101: Orthonormal Basis Generation Step)

Using the processing device, the master key generation unit 110 computesFormula 128, and randomly generates param_(n→) as well as a basis B_(t)and a basis B*_(t) for each integer t of t=0, . . . , d.

$\begin{matrix}\left\lbrack {{Formula}\mspace{14mu} 128} \right\rbrack & \; \\{\mspace{79mu} {{input}{1^{\lambda},{\overset{\rightarrow}{n}:=\left( {d;{\overset{\rightarrow}{n}:=\left( {{d;n_{1}},\ldots \mspace{11mu},n_{d},u_{0},\ldots \mspace{11mu},u_{d},w_{0},\ldots \mspace{11mu},w_{d},z_{0},\ldots \mspace{11mu},z_{d}} \right)}} \right)}}\mspace{20mu} {{N_{0}:={1 + u_{0} + 1 + w_{0} + z_{0}}};}\mspace{20mu} {N_{t}:={n_{t} + u_{t} + w_{t} + {z_{t}\left( {{t = 1},\ldots,d} \right)}}}}} & (1) \\{\mspace{79mu} {{param}_{}:={\left( {q,,_{T},g,e} \right)\overset{R}{}{_{bpg}\left( 1^{\lambda} \right)}}}} & (2) \\{\mspace{79mu} {{\psi \overset{U}{}_{q}^{x}},\mspace{20mu} {{{Steps}\mspace{14mu} (4)\mspace{14mu} {to}\mspace{14mu} (8)\mspace{14mu} {are}\mspace{14mu} {executed}\mspace{14mu} {for}\mspace{14mu} {each}\mspace{14mu} t\mspace{14mu} {of}\mspace{14mu} t} = 0}, \ldots \mspace{14mu},{d.}}} & (3) \\{{param}_{_{t}}:={\left( {q,_{t},_{T},_{t},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t},{param}_{}} \right)}}} & (4) \\{\mspace{79mu} {X_{t}:={\left( \chi_{t,i,j} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t},_{q}} \right)}}}} & (5) \\{\mspace{79mu} {\left( v_{t,i,j} \right)_{i,j}:={{\psi \cdot \left( X_{t}^{T} \right)} - 1}}} & (6) \\{\mspace{79mu} {_{t}:=\left( {b_{t,1},\ldots \mspace{11mu},b_{t},N_{t}} \right)}} & (7) \\{\mspace{79mu} {_{t}^{*}:=\left( {b_{t,1}^{*},\ldots \mspace{11mu},{b_{t,}^{*}N_{t}}} \right)}} & (8) \\{\mspace{79mu} {{param}_{\overset{\rightarrow}{n}}:=\left( {\left\{ {param}_{_{t}} \right\}_{{t = 0},\; \ldots \mspace{11mu},d,}g_{T}} \right)}} & (9)\end{matrix}$

That is, the master key generation unit 110 executes the followingsteps.

(1) Using the input device, the master key generation unit 110 inputs asecurity parameter λ(1^(λ)) and a format of attribute n{right arrow over( )}:=(d; n₁, . . . , n_(d), u₀, . . . , u_(d), w₀, . . . , w_(d), z₀, .. . , z_(d)), where d is an integer of 1 or more, n_(t) is an integer of1 or more for each integer t of t=1, . . . , d, and u_(t), w_(t), z_(t)are integers of 1 or more for each integer t of t=0, . . . d. The masterkey generation unit 110 also sets N₀:=1+u₀+1+w₀+z₀ and N_(t):=n_(t)+u_(t)+w_(t)+z_(t) for each integer t of t=1, . . . , d.

(2) Using the processing device, the master key generation unit 110executes the algorithm G_(bpg) taking as input the security parameterλ(1^(λ)) input in (1), and randomly generates values of parameterparam_(G):=(q, G, G_(T), g, e) of bilinear pairing groups.

(3) Using the processing device, the master key generation unit 110generates a random number ψ.

Then, the master key generation unit 110 executes the following steps(4) to (8) for each integer t of t=0, . . . , d.

(4) Using the processing device, the master key generation unit 110executes the algorithm G_(dpvs) taking as input the security parameterλ(1^(λ)) and N_(t) input in (1) and the values of param_(G):=(q, G,G_(T), g, e) generated in (2), and generates values of parameterparam_(Vt):=(q, V_(t), G_(T), A_(t), e) of dual pairing vector spaces.

(5) Using the processing device, the master key generation unit 110randomly generates a linear transformation X_(t):=(χ_(t,i,j))_(i,j)taking as input N_(t) set in (3) and F_(q). Note that GL stands forgeneral linear. That is, GL is a general linear group, a set of squarematrices with nonzero determinants, and a group under multiplication.(χ_(t,i,j))_(i,j) denotes a matrix associated with the subscripts i,j ofthe matrix χ_(t,i,j), where i, j=1, . . . , N_(t).

(6) Using the processing device and based on the random number ψ and thelinear transformation X_(t), the master key generation unit 110generates (ν_(t,i,j))_(i,j):=ψ·(X_(t) ^(T))⁻¹. As in the case of(χ_(t,i,j))_(i,j), (ν_(t,i,j))_(i,j) denotes a matrix associated withthe subscripts j of the matrix ν_(t,i,j) where i, j=1, . . . , N_(t).

(7) Using the processing device and based on the linear transformationX_(t) generated in (5), the master key generation unit 110 generates thebasis B_(t) from the orthonormal basis A_(t) generated in (4).

(8) Using the processing device and based on (ν_(t,i,j))_(i,j) generatedin (6), the master key generation unit 110 generates the basis B*_(t)from the orthonormal basis A_(t) generated in (4).

(9) Using the processing device, the master key generation unit 110 setse(g,g)^(ψ) in g_(T). The master key generation unit 110 also sets{param_(Vt)} _(t=0, . . . , d) generated in (4) and g_(T) in param_(n→),where g_(T)=b_(t,i), b*_(t,i)) for each integer t of t=0, . . . , d andeach integer i of i=1, . . . , N_(t).

To summarize, in (S101), the master key generation unit 110 executes thealgorithm G_(ob) shown in Formula 129, and generates param_(n→) as wellas the basis B_(t) and the basis B*_(t) for each integer t of t=0, . . ., d.

$\begin{matrix}{_{ob}\left( {1^{\lambda},{\overset{\rightarrow}{n}:={{\left( {d;{\overset{\rightarrow}{n}:=\left( {{d;n_{1}},\ldots \mspace{11mu},n_{d},u_{0},\ldots \mspace{11mu},u_{d},w_{0},\ldots \mspace{11mu},w_{d},z_{0},\ldots \mspace{11mu},z_{d}} \right)}} \right):\mspace{79mu} N_{0}}:={1 + u_{0} + 1 + w_{0} + z_{0}}}},{N_{t}:={{n_{t} + u_{t} + w_{t} + {z_{t}\mspace{79mu} {for}\mspace{14mu} t}} = 1}},\ldots \mspace{11mu},d,\mspace{79mu} {{param}_{}:={\left( {q,,_{T},g,e} \right)\overset{R}{}{_{bpg}\left( 1^{\lambda} \right)}}},\mspace{79mu} {\psi \overset{U}{}_{q}^{x}},\mspace{79mu} {{{For}\mspace{14mu} t} = 0},\ldots \mspace{11mu},d,{{param}_{_{t}}:={\left( {q,_{t},_{T},_{t},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t},{param}_{}} \right)}}},\mspace{79mu} {X_{t}:={\left( \chi_{t,i,j} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t},_{q}} \right)}}},\mspace{14mu} \mspace{79mu} {\left( v_{t,{i.j}} \right)_{i,j}:={{\psi \cdot \left( X_{t}^{T} \right)} - 1}},\mspace{79mu} {b_{t,i}:={{\left( {{\chi_{t,i,1,}\ldots}\;,\chi_{t,i,N_{t}}} \right)_{t}} = {\sum\limits_{j = 1}^{N_{t}}\; {\chi_{t,i,j}a_{t,j}}}}},\mspace{14mu} \mspace{79mu} {_{t}:=\left( {b_{t,1},\ldots \mspace{11mu},b_{t,N_{t}}} \right)},\mspace{79mu} {b_{t,i}^{*}:={{\left( {{v_{t,i,1,}\ldots}\mspace{11mu},v_{t,i,N_{t}}} \right)_{t}} = {\sum\limits_{j = 1}^{N_{t}}\; {v_{t,i,j}a_{t,j}}}}},\mspace{14mu} \mspace{79mu} {_{t}^{*}:=\left( {b_{t,1}^{*},\ldots \mspace{11mu},b_{t}^{*}{,_{N}}_{t}} \right)},\mspace{79mu} {g_{T}:={e\left( {g,g} \right)}^{\psi}},\; \mspace{20mu} {{param}_{\overset{\rightarrow}{n}}:={\left( {\left\{ {param}_{_{t}} \right\}_{{t = 0},\; \ldots \;,d,}g_{T}} \right)\mspace{79mu} {return}\mspace{14mu} {\left( {{param}_{\overset{\rightarrow}{n}},\left\{ {_{t},_{t}^{*}} \right\}_{{t = 0},\; \ldots \;,d}} \right).}}}} \right.} & \left\lbrack {{Formula}\mspace{14mu} 129} \right\rbrack\end{matrix}$

(S102: Master Public Key Generation Step)

Using the processing device, the master key generation unit 110generates a partial basis B̂₀ of the basis B₀ and a partial basis B̂_(t)of the basis B_(t) for each integer t of t=1, . . . , d, as shown inFormula 130.

₀:=(b 0,1 , b _(0,1+u) ₀ _(+1,) bd0,1+u₀ _(+1+w) ₀ _(+1,) . . . , b_(0,1+u) _(0+1+w) _(0+z) ₀ ),

_(t):=(b _(t,1) , . . . , b _(t,n) _(t) ,b _(t,n) _(t) _(+u) _(t) _(+w)_(t) ₊₁ , . . . , b _(t,n) _(t) _(+u) _(t) _(+w) _(t) _(+z) _(t) ) fort=1, . . . , d  [Formula 130]

The master key generation unit 110 designates, as a master public keypk, a combination of the generated partial basis B̂₀ and partial basisB̂_(t), the security parameter λ(1^(λ)) input in (S101), and param, thebasis vectors b*_(0,1+u0+1+1), . . . , b*_(0,1+u0+1+w0) (where u0 and w0respectively denote u₀ and w₀), and the basis vectors b*_(t,nt+ut+1), .. . , b*_(t,nt+ut+wt) (where nt, ut, and wt respectively denote n_(t),u_(t), and w_(t)) for each integer t of t=1, . . . , d generated in(S101).

(S103: Master Secret Key Generation Step)

Using the processing device, the master key generation unit 110generates a partial basis B̂*₀ of the basis B*₀ and a partial basisB̂*_(t) of the basis B*_(t) for each integer t of t=1, . . . , d, asshown in Formula 131.

*₀:=(b* _(0,1) ,b* _(0,1+u) ₀ ₊₁),

*_(t):=(b* _(t,1) , . . . , b* _(t,n) _(t) ) for t=1, . . . ,d  [Formula 131]

The master key generation unit 110 designates the generated partialbasis B̂*₀ and partial basis B̂*_(t) as a master secret key.

(S104: Master Key Storage Step)

The master key storage unit 120 stores the master public key pkgenerated in (S102) in the storage device. The master key storage unit120 also stores the master secret key sk generated in (S103) in thestorage device.

To summarize, in (S101) to (S103), the key generation device 100executes the Setup algorithm shown in Formula 132, and generates themaster public key pk and the master secret key sk. Then, in (S104), thekey generation device 100 stores the generated public parameter pk andmaster key sk in the storage device.

The master public key pk is made public through a network, for example,so as to be made available for the decryption device 300.

$\begin{matrix}{{{{{Setup}\mspace{11mu} \left( {1^{\lambda},{\overset{\rightarrow}{n}:=\left( {{d;n_{1}},\ldots \;,n_{d},u_{0},\ldots \mspace{11mu},u_{d},w_{0},\ldots \mspace{11mu},w_{d},z_{0},\ldots \mspace{11mu},z_{d}} \right)}} \right)}:\mspace{79mu} {\left( {{param}_{\overset{\rightharpoonup}{n}},\left\{ {_{t},_{t}^{*}} \right\}_{{t = 0},\; \ldots \mspace{11mu},d}} \right)\overset{R}{}{_{ob}\left( {1^{\lambda},\overset{\rightarrow}{n}} \right)}}},{{\hat{}}_{0}:=\left( {b_{0,1},b_{0,{1 + u_{0} + 1}},b_{0,{1 + u_{0} + {1w_{0}} + 1}},\ldots \;,b_{0,{1 + u_{0} + 1 + w_{0} + z_{0}}}} \right)},{{\hat{}}_{t}:=\left( {b_{t,1},\ldots \;,b_{t,n_{t}},b_{t,{n_{t} + u_{t} + w_{t} + 1}},\ldots \mspace{11mu},b_{t,{n_{t} + u_{t} + w_{t} + z_{t}}}} \right)}}\mspace{14mu} \mspace{79mu} {{{{for}\mspace{14mu} t} = 1},\ldots \;,d,\mspace{79mu} {{\hat{}}_{0}^{*}:=\left( {b_{0,1}^{*},b_{0,{1 + u_{0} + 1}}^{*}} \right)},\mspace{79mu} {{\hat{}}_{t}^{*}:={{\left( {b_{t,1}^{*},\ldots \;,b_{t,n_{t}}^{*}} \right)\mspace{14mu} {for}\mspace{14mu} t} = 1}},\ldots \;,d,{{pk}:=\left( {1^{\lambda},{param}_{\overset{\rightharpoonup}{n}},\left\{ {\hat{}}_{t} \right\}_{{t = 0},\ldots \mspace{11mu},d},\; b_{01 + u_{0} + 1 + 1}^{*},\ldots \;,b_{0,{1 + u_{0} + 1 + w_{0}}}^{*},\left\{ {b_{t,{n_{t} + u_{t}},{+ 1}}^{*},\ldots \mspace{11mu},b_{t,{n_{t} + u_{t} + w_{t}}}^{*}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{11mu},d}} \right)},\mspace{79mu} {{sk}:=\left\{ {\hat{}}_{t}^{*} \right\}_{{t = 0},\; {\ldots \mspace{11mu} d}}},\mspace{79mu} {{return}\mspace{14mu} {pk}},{{sk}.}}} & \left\lbrack {{Formula}\mspace{14mu} 132} \right\rbrack\end{matrix}$

Referring to FIG. 13, the process of the KeyGen algorithm executed bythe key generation device 100 will now be described.

(S201: Information Input Step)

Using the input device, the information input unit 130 inputs predicateinformation (v{right arrow over ( )}₁, . . . , v{right arrow over ()}_(L)):=((v_(1,i) (i=1, . . . , n₁)), . . . , (v_(L,i) (i=1, . . . ,n_(L)))). As predicate information, an attribute of a user of a key isinput.

(S202: Random Number Generation Step)

Using the processing device, the random number generation unit 141generates a random number ψ, random numbers s_(dec,t), s_(ran,j,t) (t=1,. . . , L), random numbers θ_(dec,t), θ_(ran,j,t), η{right arrow over ()}_(dec,t), η{right arrow over ( )}_(ran,j,t) (t=0, . . . , L), randomnumbers s_(ran,(τ,ι)t), s_(del,(τ,ι),t) (t=1, . . . , L+1), and randomnumbers θ_(ran,(τ,ι),t), θ_(del,(τ,ι),t), η{right arrow over ()}_(ran,(τ,ι),t), η{right arrow over ( )}_(del,(τ,ι),t) (t=0, . . . ,L+1) for each integer j, τ, ι of j=1, . . . , 2L, τ of τ=L+1, . . . d,and (τ,ι)=(τ,1), . . . , (τ,n_(τ)), as shown in Formula 133.

$\begin{matrix}{\mspace{79mu} {{for}\mspace{79mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}\mspace{79mu} {{\tau = {L + 1}},\ldots \mspace{14mu},{d;}}\mspace{79mu} {{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}\mspace{79mu} {\psi,s_{{dec},t},{s_{{ran},j,t}\overset{U}{}{_{q}\left( {{t = 1},\ldots \mspace{14mu},L} \right)}},\mspace{79mu} \theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{}{_{q}\left( {{t = 0},\ldots \mspace{14mu},L} \right)}},{{\overset{->}{\eta}}_{{dec},t}:={\left( {\eta_{{dec},t,1},\ldots \mspace{14mu},\eta_{{dec},t,w_{t}}} \right)\overset{U}{}{_{q}^{w_{t}}\left( {{t = 0},\ldots \mspace{14mu},L} \right)}}},{{\overset{->}{\eta}}_{{ran},j,t}:={\left( {\eta_{{ran},j,t,1},\ldots \mspace{14mu},\eta_{{ran},j,t,w_{t}}} \right)\overset{U}{}{_{q}^{w_{t}}\left( {{t = 0},\ldots \mspace{14mu},L} \right)}}},\mspace{79mu} s_{{ran},{({\tau,l})},t},{s_{{del},{({\tau,l})},t}\overset{U}{}{_{q}\left( {{t = 1},\ldots \mspace{14mu},{L + 1}} \right)}},\mspace{79mu} \theta_{{ran},{({\tau,l})},t},{\theta_{{del},{({\tau,l})},t}\overset{U}{}{_{q}\left( {{t = 0},\ldots \mspace{14mu},{L + 1}} \right)}},{{\overset{->}{\eta}}_{{ran},{({\tau,l})},t}:={\left( {\eta_{{ran},{({\tau,l})},t,1},\ldots \mspace{14mu},\eta_{{ran},{({\tau,l})},t,w_{t}}} \right)\overset{U}{}{_{q}^{w_{t}}\left( {{t = 0},\ldots \mspace{14mu},{L + 1}} \right)}}},{{\overset{->}{\eta}}_{{del},{({\tau,l})},t}:={\left( {\eta_{{del},{({\tau,l})},t,1},\ldots \mspace{14mu},\eta_{{del},{({\tau,l})},t,w_{t}}} \right)\overset{U}{}{_{q}^{w_{t}}\left( {{t = 0},\ldots \mspace{14mu},{L + 1}} \right)}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 133} \right\rbrack\end{matrix}$

Also, s_(dec,0), s_(ran,j,0), s_(ran,(τ,ι),0), and s_(del,(τ,ι),0) areset as shown in Formula 134.

s _(dec,0):=Σ_(t=1) ^(L) s _(dec,t),

s _(ran,j,0):=Σ_(t=1) ^(L) s _(ran,j,t),

s _(ran,(τ,ι),0):=Σ_(t=1) ^(L+1) s _(ran,(τ,ι),t),

s _(del,(τ,ι),0):=Σ_(t=1) ^(L+1) s _(del,(τ,ι),t)  [Formula 134]

(S203: Decryption Element Generation Step)

Using the processing device, the decryption element generation unit 142generates a decryption element k*_(L,dec) which is an element of adecryption key sk_(L), as shown in Formula 135.

k* _(L,dec):=((−s _(dec,0),0^(u) ⁰ ,1,{right arrow over(η)}_(dec,0),0^(z) ⁰

, (s _(dec,t) {right arrow over (e)} _(t,1)+θ_(dec,t) {right arrow over(v)} _(t),0^(u) ^(t) ,{right arrow over (η)}_(dec,t),0^(z) ^(t)

:t=1, . . . , L)  [Formula 135]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 135 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the decryption elementk*_(L,dec).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(dec,0) is set as a coefficient of a basis vector 1 of the basis B*₀.0 is set as a coefficient of each of basis vectors 1+1, . . . , 1+u₀. 1is set as a coefficient of a basis vector 1+u₀+1. η_(dec,0,1), . . . ,η_(dec,0,w0) (where w0 denotes w₀) are respectively set as coefficientsof basis vectors 1+u₀+1+1, . . . , 1+u₀+1+w₀. 0 is set as a coefficientof each of basis vectors 1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3).

s_(dec,t)+θ_(dec,t)v_(t,1) is set as a coefficient of a basis vector 1of the basis B*_(t) (t=1, . . . , L). θ_(dec,t)v_(t,2), . . . ,θ_(dec,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 2, . . . , n_(t). 0 is set as acoefficient of each of basis vectors n_(t)+1, . . . , n_(t)+u_(t).η_(dec,t,1), . . . , η_(dec,t,wt) (where wt denotes w_(t)) arerespectively set as coefficients of basis vectors n_(t)+u_(t)+1, . . . ,n_(t)+u_(t)+w_(t). 0 is set as a coefficient of each of basis vectorsn_(t)+u_(t)+w_(t)+1, . . . , n_(t)+u_(t)+w_(t)+z_(t).

(S204: First Randomizing Element Generation Step)

Using the processing device, the randomizing element generation unit 143generates a first randomizing element k*_(L,ran,j) which is an elementof the decryption key sk_(L), for each integer j of j=1, . . . , 2L, asshown in Formula 136.

k* _(L,ran,j):=((−s _(ran,j,0)0^(u) ⁰ ,0,{right arrow over(η)}_(ran,j,0),0^(z) ⁰

, (s _(ran,j,t) {right arrow over (e)} _(t,1)+θ_(ran,j,t) {right arrowover (v)} _(t),0^(u) ^(t) ,{right arrow over (η)}_(ran,j,t),0^(z) ^(t)

:t=1, . . . , L)  [Formula 136]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 136 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the first randomizing elementk*_(L,ran,j).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(ran,j,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(ran,j,0,1), . . . , η_(ran,j,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3).

s_(ran,j,t)+θ_(ran,j,t)v_(t,1) is set as a coefficient of a basis vector1 of the basis B*_(t) (t=1, . . . , L). θ_(ran,j,t)v_(t,2), . . . ,θ_(ran,j,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 2, . . . , n_(t). 0 is set as acoefficient of each of basis vectors n_(t)+1, . . . , n_(t)+u_(t).η_(ran,j,t,1), . . . , η_(ran,j,t,wt) (where wt denotes w_(t)) arerespectively set as coefficients of basis vectors n_(t)+u_(t)+1, . . . ,n_(t)+u_(t)+w_(t). 0 is set as a coefficient of each of basis vectorsn_(t)+u_(t)+w_(t)+1, . . . , n_(t)+u_(t)+w_(t)+z_(t).

(S205: Second Randomizing Element Generation Step)

Using the processing device, the randomizing element generation unit 143generates a second randomizing element k*_(L,ran,(τ,ι)) which is anelement of the decryption key sk_(L), for each integer τ of τ=L+1, . . ., d and each integer ι of ι=1, . . . , n_(t) with respect to eachinteger τ, as shown in Formula 137.

k* _(L,ran,(τ,ι)) L=((−s _(ran,(τ,ι),0),0^(u) ⁰ ,0,{right arrow over(η)}_(ran,(τ,ι),0),0^(z) ⁰

,(s _(ran,(τ,ι),t) {right arrow over (e)} _(t,1)+θ_(ran,(τ,ι),t) {rightarrow over (v)} _(t),0^(u) ^(t) ,{right arrow over(η)}_(ran,(τ,ι),t),0^(z) ^(t)

:t=1, . . . , L(s _(ran,(τ,ι),L+1) {right arrow over (e)} _(τ,1),0^(y)^(τ) ,{right arrow over (n)} _(ran,(τ,ι),L+1),0^(z) ^(τ)

  [Formula 137]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 137 denotes that coefficientsof basis vectors of the basis B*₀, the basis B*_(t) (t=1, . . . , L),and a basis B*_(τ) are set as described below to generate the secondrandomizing element k*_(L,ran,(τ,ι)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(ran,(τ,ι),0) is set as a coefficient of a basis vector 1 of thebasis B*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . ., 1+u₀+1. η_(ran,(τ,ι),0,1), . . . , η_(ran,(τ,ι),0,w0) (where w0denotes w₀) are respectively set as coefficients of basis vectors1+u₀+1+1, . . . , 1+u₀+1+w₀. 0 is set as a coefficient of each of basisvectors 1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3).

s_(ran,(τ,ι),t)+θ_(ran,(τ,ι),t)v_(t,1) is set as a coefficient of abasis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(ran,(τ,ι),t)v_(t,2), . . . , θ_(ran,(τ,ι),t)v_(t,nt) (where ntdenotes n_(t)) are respectively set as coefficients of basis vectors 2,. . . , n_(t). 0 is set as a coefficient of each of basis vectorsn_(t)+1, . . . , n_(t)+u_(t). η_(ran,(τ,ι),t,1), . . . ,η_(ran,(τ,ι),t,wt) (where wt denotes w_(t)) are respectively set ascoefficients of basis vectors n_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t).0 is set as a coefficient of each of basis vectors n_(t)+u_(t)+w_(t)+1,. . . , n_(t)+u_(t)+w_(t)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τ,1), . . . ,b*_(τ,3).

s_(ran,(τ,ι),L+)1 is set as a coefficient of a basis vector 1 of thebasis B*_(τ). 0 is set as a coefficient of each of basis vectors 2, . .. , n_(τ), . . . n_(τ)+u_(τ. η) _(ran,(τ,ι),L+1,1), . . . ,η_(ran,(τ,ι),L+1,wτ) (where wτ denotes w_(t)) are respectively set ascoefficients of basis vectors n_(τ)+u_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ).0 is set as a coefficient of each of basis vectors n_(τ)+u_(τ)+w_(τ)+1,. . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S206: Delegation Element Generation Step)

Using the processing device, the delegation element generation unit 144generates a delegation element k*_(L,del,(τ,ι)) which is an element ofthe decryption key sk_(L), for each integer τ of τ=L+1, . . . , d andeach integer ι of ι=1, . . . , n_(τ) with respect to each integer τ, asshown in Formula 138.

k* _(L,del,(τ,ι):=((−s) _(del,(τ,ι,0),0^(u) ⁰ ,0,{right arrow over(η)}_(del,(τ,ι),0),0^(z) ⁰

,(s _(del,(τ,ι),t) {right arrow over (e)} _(t,1)+θ_(del,(τ,ι),t) {rightarrow over (v)} _(t),0^(u) ^(t) ,{right arrow over(η)}_(del,(τ,ι),t),0^(z) ^(t)

:t=1, . . . , L(s _(del,(τ,ι),L+1{right arrow over (e)}) _(τ,1) +ψ{rightarrow over (e)} _(τ,ι),0^(u) ^(τ) ,{right arrow over(η)}_(del,(τ,ι),L+1),0^(z) ^(τ)

)  [Formula 138]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 138 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the delegation elementk*_(L,del,(τ,ι)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(del,(τ,t),0) is set as a coefficient of a basis vector 1 of thebasis B*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . ., 1+u₀+1. η_(del,(τ,ι),0,1), . . . , η_(del,(τ,ι),0,w0) (where w0denotes w₀) are respectively set as coefficients of basis vectors1+u₀+1+1, . . . , 1+u₀+1+w₀. 0 is set as a coefficient of each of basisvectors 1+u₀+l+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3).

s_(del,(τ,ι),t)+θ_(del,(τ,ι),t)v_(t,1) is set as a coefficient of abasis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(del,(τ,ι),t)v_(t,2), . . . , θ_(del,(τ,ι),t)v_(t,nt) (where ntdenotes n_(t)) are respectively set as coefficients of basis vectors 2,. . . , n_(t). 0 is set as a coefficient of each of basis vectorsn_(t)+1, . . . , n_(t)+u_(t), η_(del,(τ,ι),t,1), . . . ,η_(del,(τ,ι),t,wt) (where wt denotes w_(t)) are respectively set ascoefficients of basis vectors n_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t).0 is set as a coefficient of each of basis vectors n_(t)+u_(t)+w_(t)+1,. . . , n_(t)+u_(t)±w_(t)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τ,1), . . . ,b*_(τ,3).

s_(del,(τ,ι),L+1)e{right arrow over ( )}_(τ,1)+ψe{right arrow over ()}_(τ,ι) is set as a coefficient of each of basis vectors 1, . . . ,n_(τ) of the basis B*_(τ). 0 is set as a coefficient of each of basisvectors n_(τ)+1, . . . , n_(τ)+u_(τ). η_(del,(τ,ι),L+1,1), . . . ,η_(del,(τ,ι),L+1,wτ) (where wτ denotes w_(τ)) are respectively set ascoefficients of basis vectors n_(τ)+u_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ).0 is set as a coefficient of each of basis vectors n_(τ)+u_(τ)+w_(τ)+1,. . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S207: Key Distribution Step)

Using the communication device and through the network, for example, thekey distribution unit 150 secretly provides to the decryption device 300the decryption key sk_(L) having elements of the decryption elementk*_(L,dec), the first randomizing element k*_(L,ran,j) (j=1, . . . ,2L), the second randomizing element k*_(L,ran,(τ,ι)) (τ=L+1, . . . , d;(τ,ι)=(τ,1), . . . , (τ,n_(τ))), and the delegation elementk*_(L,del,(τ,ι)) (τ=L+1, . . . , d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))). Itis obvious that the decryption key sk_(L) may be provided to thedecryption device 300 by other methods.

To summarize, in (S201) to (S206), the key generation device 100executes the KeyGen algorithm shown in Formulas 139 and 140, andgenerates the decryption key sk_(L). Then, in (S207), the key generationdevice 100 provides the generated decryption key sk_(L) to thedecryption device 300.

$\begin{matrix}{{{KeyGen}\left( {{pk},{sk},{\left( {{\overset{->}{v}}_{1},\ldots \mspace{14mu},{\overset{->}{v}}_{L}} \right):=\left( {v_{1,1},\ldots \mspace{14mu},v_{1,n_{1}}} \right)}, \ldots \mspace{14mu},\left( {v_{L,1},\ldots \mspace{14mu},v_{L,n_{L}}} \right)} \right)}:} & \left\lbrack {{Formula}\mspace{14mu} 139} \right\rbrack \\{\mspace{11mu} {{for}\mspace{79mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}\mspace{79mu} {{\tau = {L + 1}},\ldots \mspace{14mu},{d;}}\mspace{79mu} {{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);\mspace{79mu} \psi},s_{{dec},t},{{{s_{{ran},j,t}\overset{U}{}_{q}}\mspace{14mu} \left( {{t = 1},\ldots \mspace{14mu},L} \right)};}}}} & \; \\{\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{}_{q}},{\overset{->}{\eta}}_{{dec},t},{{{{\overset{->}{\eta}}_{{ran},j,t}\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)};}} & \; \\{s_{{ran},{({\tau,l})},t},{{{s_{{del},{({\tau,l})},t}\overset{U}{}_{q}}\mspace{14mu} \left( {{t = 1},\ldots \mspace{14mu},{L + 1}} \right)};}} & \; \\{\theta_{{ran},{({\tau,l})},t},{\theta_{{del},{({\tau,l})},t}\overset{U}{}_{q}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},{{\overset{->}{\eta}}_{{del},{({\tau,l})},t}\overset{U}{}_{q}^{w_{t}}},{\left( {{t = 0},\ldots \mspace{14mu},{L + 1}} \right);}} & \; \\{{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},} & \; \\{{s_{{ran},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{ran},{({\tau,l})},t}}},{s_{{del},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},{({\tau,l})},t}}},} & \; \\{{k_{L,{dec}}^{*}:=\left( {\left( {{- s_{{dec},0}},0^{u_{0}},1,{\overset{->}{\eta}}_{{dec},0},0^{z_{0}}} \right)_{_{0}^{*}},{{\left( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} \right)_{_{t}^{*}}:t} = 1},\ldots \mspace{14mu},L} \right)},} & \left\lbrack {{Formula}\mspace{14mu} 140} \right\rbrack \\{{k_{L,{ran},j}^{*}:=\left( {\left( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} \right)_{_{0}^{*}},{{\left( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} \right)_{_{t}^{*}}:t} = 1}, \ldots \mspace{14mu},L} \right)},} & \; \\{{{k_{L,{ran},{({\tau,l})}}^{*}:=\left( {\left( {{- s_{{ran},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},{({\tau,l})},0},0^{z_{0}}} \right)_{_{0}^{*}},{{\left( {{{s_{{ran},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},0^{z_{t}}} \right)_{_{t}^{*}}:t} = 1}, \ldots \mspace{14mu},{L\left( {{s_{{ran},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},{L + 1}},0^{z_{\tau}}} \right)}_{_{\tau}^{*}}} \right)},}\mspace{11mu}} & \; \\{{k_{L,{del},{({\tau,l})}}^{*}:=\left( {\left( {{- s_{{del},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},{({\tau,l})},0},0^{z_{0}}} \right)_{_{0}^{*}},{{\left( {{{s_{{del},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},{({\tau,l})},t},0^{z_{t}}} \right)_{_{t}^{*}}:t} = 1}, \ldots \mspace{14mu},{L\left( {{{s_{{del},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}} + {\psi {\overset{->}{e}}_{\tau,l}}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},{({\tau,l})},{L + 1}},0^{z_{\tau}}} \right)}_{_{\tau}^{*}}} \right)},} & \; \\{{{sk}_{L}:=\left( {k_{L,{dec}}^{*},\left\{ k_{L,{ran},j}^{*} \right\}_{{j = 1},\mspace{11mu} \ldots \mspace{14mu},{2L}},\left\{ k_{L,{ran},{({\tau,l})}}^{*} \right\}_{{\tau = {L + 1}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}},\left\{ k_{L,{del},{({\tau,l})}}^{*} \right\}_{{\tau = {L + 1}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,l})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}}} \right)},} & \; \\{{return}\mspace{14mu} {{sk}_{L}.}} & \;\end{matrix}$

The functions and operations of the encryption device 200 will bedescribed.

As shown in FIG. 9, the encryption device 200 includes a master publickey acquisition unit 210, an information input unit 220 (secondinformation input unit), a ciphertext generation unit 230, and a datatransmission unit 240.

The information input unit 220 includes an attribute information inputunit 221 and a message input unit 222. The ciphertext generation unit230 includes a random number generation unit 231, a ciphertext c1generation unit 232, and a ciphertext c2 generation unit 233.

Referring to FIG. 14, the process of the Enc algorithm executed by theencryption device 200 will be described.

(S301: Master Public Key Acquisition Step)

Using the communication device and through the network, for example, themaster public key acquisition unit 210 obtains the master public key pkgenerated by the key generation device 100.

(S302: Information Input Step)

Using the input device, the attribute information input unit 221 inputsattribute information (x{right arrow over ( )}₁, . . . , x{right arrowover ( )}_(L)):=((x_(1,i) (i=1, . . . , n₁)), . . . , (x_(L,i) (i=1, . .. , n_(L)))). As attribute information, an attribute of a person who candecrypt an encrypted message is input.

Using the input device, the message input unit 222 inputs a message m tobe encrypted.

(S303: Random Number Generation Step)

Using the processing device, the random number generation unit 231generates random numbers (x̂_(L+1), . . . , x{right arrow over ()}_(d)):=((x_(L+1,i) (i=1, . . . , n_(L+1))), . . . , (x_(d,i) (i=1, . .. , n_(d)))) and random numbers ω, ζ, φ{right arrow over ( )}_(t) (t=0,. . . , d), as shown in Formula 141.

$\begin{matrix}{{\left( {{\overset{->}{x}}_{L + 1},\ldots \mspace{14mu},{\overset{->}{x}}_{d}} \right):={{\left( {\left( {x_{{L + 1},1},\ldots \mspace{14mu},x_{{L + 1},n_{L + 1}}} \right),\ldots \mspace{14mu},\left( {x_{d,1},\ldots \mspace{14mu},x_{d,n_{d}}} \right)} \right)\overset{U}{}_{q}^{n_{L + 1}}} \times \ldots \times _{q}^{n_{d}}}},\mspace{79mu} \omega,{\zeta \overset{U}{}_{q}},\mspace{45mu} \mspace{79mu} {{\overset{->}{\phi}}_{t}:={\left( {\phi_{t,1},\ldots \mspace{14mu},\phi_{t,z_{t}}} \right)\overset{U}{}{_{q}^{z_{t}}\left( {{t = 0},\ldots \mspace{14mu},d} \right)}}}} & \left\lbrack {{Formula}\mspace{14mu} 141} \right\rbrack\end{matrix}$

(S304: Ciphertext c1 Generation Step)

Using the processing device, the ciphertext c1 generation unit 232generates a ciphertext c₁ which is an element of a ciphertext ct, asshown in Formula 142.

c ₁:=((ω,0^(u) ⁰ ,ζ,0^(w) ⁰ ,{right arrow over (φ)}₀

,(ω{right arrow over (x)} _(t),0^(u) ^(t) ,0^(w) ^(t) ,{right arrow over(φ)}_(t)

:t=1, . . . , d)  [Formula 142]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 142 denotes that coefficientsof basis vectors of the basis B₀ and the basis B_(t) (t=1, . . . , d)are set as described below to generate the ciphertext c₁.

First, description will be directed to the basis B₀. For simplicity ofnotation, a basis vector b_(0,i) is identified using only the i portion.For example, a basis vector 1 denotes a basis vector b_(0,1). Basisvectors 1, . . . , 3 denote basis vectors b_(0,1), . . . , b_(0,3).

ω is set as a coefficient of a basis vector 1 of the basis B₀. 0 is setas a coefficient of each of basis vectors 1+1, . . . , 1+u₀. ζ is set asa coefficient of a basis vector 1+u₀+1. 0 is set as a coefficient ofeach of basis vectors 1+u₀+1+1, . . . , 1+u₀+1+w₀. φ_(0,1), . . . ,φ_(0,z0) (where z0 denotes z₀) are respectively set as coefficients ofbasis vectors 1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B_(t) (t=1, . . . , d).For simplicity of notation, a basis vector b_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b_(t,1), . . ., b_(t,3).

ωx_(t,1), . . . , ωx_(t,nt) (where nt denotes n_(t)) are respectivelyset as coefficients of basis vectors 1, . . . , n_(t) of the basis B_(t)(t=1, . . . , d). 0 is set as a coefficient of each of basis vectorsn_(t)+1, . . . , n_(t)+u_(t)+w_(t). φ_(t,1), . . . , φ_(t,zt) (where ztdenotes z_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+w_(t)+1, . . . , n_(t)+u_(t)+w_(t)+z_(t).

(S305: Ciphertext c2 Generation Step)

Using the processing device, the ciphertext c2 generation unit 233generates a ciphertext c₂ which is an element of the ciphertext ct, asshown in Formula 143.

c ₂ :=g _(T) ^(ζ) m  [Formula 143]

(S306: Data Transmission Step)

Using the communication device and through the network, for example, thedata transmission unit 240 transmits to the decryption device 300 theciphertext ct including the ciphertext c₁ and the ciphertext c₂. It isobvious that the ciphertext ct may be transmitted to the decryptiondevice 300 by other methods.

To summarize, in (S301) to (S305), the encryption device 200 executesthe Enc algorithm shown in Formula 144, and generates the ciphertext ct.Then, in (S306), the encryption device 200 transmits the generatedciphertext ct to the decryption device 300.

$\begin{matrix}{{Enc}\left( {{pk},{m \in _{T}},{{\left( {{\overset{->}{x}}_{1},\ldots \mspace{14mu},{\overset{->}{x}}_{L}} \right):={\left( {\left( {x_{1,1},\ldots \mspace{14mu},x_{1,n_{1}}} \right),\ldots \mspace{14mu},\left( {x_{L,1},\ldots \mspace{14mu},x_{L,n_{L}}} \right)} \right):\mspace{79mu} {{\left( {{\overset{->}{x}}_{L + 1},\ldots \mspace{14mu},{\overset{->}{x}}_{d}} \right)\overset{U}{}_{q}^{n_{L + 1}}} \times \ldots \times _{q}^{n_{d}}}}};\mspace{79mu} \omega},{\zeta \overset{U}{}_{q}},{{\overset{->}{\phi}}_{t}\overset{U}{}{_{q}^{z_{t}}\left( {{t = 0},\ldots \mspace{14mu},d} \right)}},{c_{1}:=\left( {\left( {\omega,0^{u_{0}},\zeta,0^{w_{0}},{\overset{->}{\phi}}_{0}} \right)_{_{0}},{{\left( {{\omega \; {\overset{->}{x}}_{t}},0^{u_{t}},0^{w_{t}},{\overset{->}{\phi}}_{t}} \right)_{\; t}:t} = 1},\ldots \mspace{14mu},d} \right)},\mspace{79mu} {c_{2}:={g_{T}^{\zeta}m}},\mspace{79mu} {{ct}:=\left( {c_{1},c_{2}} \right)},\mspace{79mu} {{return}\mspace{14mu} {{ct}.}}} \right.} & \left\lbrack {{Formula}\mspace{14mu} 144} \right\rbrack\end{matrix}$

The functions and operations of the decryption device 300 will bedescribed.

As shown in FIG. 10, the decryption device 300 includes a decryption keyacquisition unit 310, a data receiving unit 320, a pairing operationunit 330, and a message computation unit 340.

Referring to FIG. 15, the process of the Dec algorithm executed by thedecryption device 300 will be described.

(S401: Decryption Key Acquisition Step)

Using the communication device and through the network, for example, thedecryption key acquisition unit 310 obtains the decryption key sk_(L).The decryption key acquisition unit 310 also obtains the publicparameter pk generated by the key generation device 100.

(S402: Data Receiving Step)

Using the communication device and through the network, for example, thedata receiving unit 320 receives the ciphertext ct transmitted by theencryption device 200.

(S403: Pairing Operation Step)

Using the processing device, the pairing operation unit 330 performs apairing operation shown in Formula 145, and computes a session keyK=g_(T) ^(ζ).

K:=e(c ₁ ,k* _(L,dec))  [Formula 145]

If the inner product of (v{right arrow over ( )}₁, . . . , {right arrowover (v)}_(L)) and (x{right arrow over ( )}₁, . . . , x{right arrow over( )}_(L)) is 0, the session key K is computed by computing Formula 145.

(S404: Message Computation Step)

Using the processing device, the message computation unit 340 computes amessage m′(=m) by dividing the ciphertext c2 by the session key K.

To summarize, in (S401) to (S404), the decryption device 300 executesthe Dec algorithm shown in Formula 146, and computes the message m′(=m).

Dec(pk,k* _(L,dec) ,ct):m′:=c ₂ ,be(c ₁ ,k* _(L,dec))returnm′.  [Formula 146]

The functions and operations of the key delegation device 400 will bedescribed.

As shown in FIG. 11, the key delegation device 400 includes a decryptionkey acquisition unit 410, an information input unit 420 (thirdinformation input unit), a delegation key generation unit 430, and a keydistribution unit 440 (delegation key transmission unit).

The delegation key generation unit 430 includes a random numbergeneration unit 431, a lower-level decryption element generation unit432, a lower-level randomizing element generation unit 433, and alower-level delegation element generation unit 434.

Referring to FIG. 16, the process of the Delegate_(L) algorithm executedby the key delegation device 400 will be described.

(S501: Decryption Key Acquisition Step)

Using the communication device and through the network, for example, thedecryption key acquisition unit 410 obtains the decryption key sk_(L).The decryption key acquisition unit 410 also obtains the publicparameter pk generated by the key generation device 100.

(S502: Information Input Step)

Using the input device, the information input unit 420 inputs predicateinformation v{right arrow over ( )}_(L+1)=(v_(L+1,i) (i=1, . . . ,n_(L+1))). As predicate information, an attribute of a person to whomthe key is delegated is input.

(S503: Random Number Generation Step)

Using the processing device, the random number generation unit 431generates random numbers α_(dec,j), σ_(dec), α_(ran,j′,j), σ_(ran,j′),α_(ran,(τ,ι),j), σ_(ran,(τ,ι)), φ_(ran,(τ,ι)), α_(del,(τ,ι),j),σ_(del,(τ,ι)), φ_(del,(τ,ι)), ψ′, η_(dec,(t,i)), η_(ran,j′,(t,i)),η_(ran,(τ,ι,(t,i)), η_(del,(τ,ι),(t,i)) for each integer j, j′, τ, ι, t,i of j=1, . . . , 2L, j′=1, . . . , 2(L+1), τ=L+2, . . . , d,(τ,ι)=(τ,1), . . . , (τ,n_(τ)), t=0, . . . , L+1, τ, (t,i)=(t,1), . . ., (t,n_(t)), as shown in Formula 147.

$\begin{matrix}{{{for}{j = 1},\ldots \mspace{14mu},{{2L};}}{{j^{\prime} = 1},\ldots \mspace{14mu},{{2\left( {L + 1} \right)};}}{{\tau = {L + 2}},\ldots \mspace{14mu},{d;}}{{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}{{t = 0},\ldots \mspace{14mu},{L + 1},{\tau;}}{{\left( {t,i} \right) = \left( {t,1} \right)},\ldots \mspace{14mu},{\left( {t,w_{t}} \right);}}{\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l})},j},\sigma_{{ran},{({\tau,l})}},\varphi_{{ran},{({\tau,l})}},\alpha_{{del},{({\tau,l})},j},\sigma_{{del},{({\tau,l})}},\varphi_{{del},{({\tau,l})}},\psi^{\prime},\eta_{{dec},{({t,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l})},{({t,i})}},{\eta_{{del},{({\tau,l})},{({t,i})}}\overset{U}{}_{q}}}} & \left\lbrack {{Formula}\mspace{14mu} 147} \right\rbrack\end{matrix}$

(S504: Lower-Level Decryption Element Generation Step)

Using the processing device, the lower-level decryption elementgeneration unit 432 generates a lower-level decryption elementk*_(L+1,dec) which is an element of a delegation key sk_(L+1), as shownin Formula 148.

$\begin{matrix}{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 148} \right\rbrack\end{matrix}$

(S505: First Lower-Level Randomizing Element Generation Step)

Using the processing device, the lower-level randomizing elementgeneration unit 433 generates a first lower-level randomizing elementk*_(L+1,ran,j′) which is an element of the delegation key sk_(L+1), foreach integer j′ of j′=1, . . . , 2(L+1), as shown in Formula 149.

$\begin{matrix}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 149} \right\rbrack\end{matrix}$

(S506: Second Lower-Level Randomizing Element Generation Step)

Using the processing device, the lower-level randomizing elementgeneration unit 433 generates a second lower-level randomizing elementk*_(L+1,ran,(τ,ι)) which is an element of the delegation key sk_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 150.

$\begin{matrix}{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\varphi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \left\lbrack {{Formula}\mspace{14mu} 150} \right\rbrack\end{matrix}$

(S507: Lower-Level Delegation Element Generation Step)

Using the processing device, the lower-level delegation elementgeneration unit 434 generates a lower-level delegation elementk*_(L+1,del,(τ,ι)) which is an element of the delegation key sl_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 151.

$\begin{matrix}{{k_{{L + 1},{del},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\psi^{\prime}k_{L,{del},{({\tau,i})}}^{*}} + {\varphi_{{del},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,i})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \left\lbrack {{Formula}\mspace{14mu} 151} \right\rbrack\end{matrix}$

(S508: Key Distribution Step)

Using the communication device and through the network, for example, thekey distribution unit 150 secretly provides to the lower-leveldecryption device 300 the delegation key sk_(L+1) (lower-leveldecryption key) having elements of the lower-level decryption element_(k*L+1,dec), the first lower-level randomizing element k*_(L+1,ran,j′)(j′=1, . . . , 2(L+1)), the second lower-level randomizing elementk*_(L+1,ran,(τ,ι))(τ=L+2, . . . , d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))),and the lower-level delegation element k*_(L+1,del,(τ,ι)) (τ=L+2, . . ., d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))). It is obvious that the delegationkey sk_(L+1) may be provided to the lower-level decryption device 300 byother methods.

To summarize, in (S501) to (S507), the key delegation device 400executes the Delegate_(L), algorithm shown in Formulas 152 and 153, andgenerates the delegation key sk_(L+1). Then, in (S508), the keydelegation device 400 provides the generated delegation key sk_(L+1) tothe lower-level decryption device 300.

$\begin{matrix}{{{Delegate}_{L}\left( {{pk},{sk}_{L},{{\overset{->}{v}}_{L + 1}:=\left( {v_{{L + 1},1},\ldots \mspace{14mu},v_{{L + 1},n_{L + 1}}} \right)}} \right)}:} & \left\lbrack {{Formula}\mspace{14mu} 152} \right\rbrack \\{ {{for}\mspace{79mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}\mspace{79mu} {{j^{\prime} = 1},\ldots \mspace{14mu},{{2\left( {L + 1} \right)};}}\mspace{79mu} {{\tau = {L + 2}},\ldots \mspace{14mu},{d;}}\mspace{79mu} {{\left( {\tau,l} \right) = \left( {\tau,l} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}\mspace{79mu} {{t = 0},\ldots \mspace{14mu},{L + 1},{\tau;}}}} & \; \\{\mspace{76mu} {{{\left( {t,i} \right) = \left( {t,1} \right)},\ldots \mspace{14mu},{\left( {t,w_{t}} \right);}}\mspace{79mu} {\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l})},j},\sigma_{{ran},{({\tau,l})}},\mspace{79mu} \varphi_{{ran},{({\tau,l})}},\alpha_{{del},{({\tau,l})},j},\sigma_{{del},{({\tau,l})}},\varphi_{{del},{({\tau,l})}},\psi^{\prime},\mspace{79mu} \eta_{{dec},{({l,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l})},{({t,i})}},{\eta_{{del},{({\tau,l})},{({t,i})}}\overset{U}{}_{q}},}}} & \; \\{{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}},} & \left\lbrack {{Formula}\mspace{14mu} 153} \right\rbrack \\{{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}},} & \; \\{{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\varphi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{k_{{L + 1},{del},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\psi^{\prime}k_{L,{del},{({\tau,l})}}^{*}} + {\varphi_{{del},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{del},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{{sk}_{L + 1}:=\left( {k_{{L + 1},{dec}}^{*},\left\{ k_{{L + 1},{ran},j^{\prime}}^{*} \right\}_{{j^{\prime} = 1},\mspace{11mu} \ldots \mspace{14mu},{2{({L + 1})}}},\left\{ {k_{{L + 1},{ran},{({\tau,l})}}^{*},k_{{L + 1},{del},{({\tau,l})}}^{*}} \right\}_{{\tau = {L + 2}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,t})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}}} \right)},\mspace{79mu} {{return}\mspace{14mu} {sk}_{L + 1}}} & \;\end{matrix}$

When the lower-level decryption device 300 executes the Dec algorithmusing the delegation key sk_(L+1), the session key K is computed in(S403) of FIG. 15 by computing Formula 145 if the inner product of(v{right arrow over ( )}₁, . . . , v{right arrow over ( )}_(L+1)) and(x{right arrow over ( )}₁, . . . , x{right arrow over ( )}_(L+1)) is 0.

As described above, the cryptographic processing system 10 according tothe first embodiment implements the HPE scheme for inner products of dlevels using the (d+1) number of N_(t) (t=0, . . . , d)-dimensionalspaces. Spaces required for the cryptographic processes at the L-thlevel (1≦L≦d) are the (L+1) number of N_(t) (t=0, . . . , L)-dimensionalspaces. Thus, key sizes can be made small, and efficiency of operationsand so on can be enhanced. Memory and register areas and so on forstoring keys are also made small.

In the above description, dimensions u_(t), w_(t), and z_(t) (t=0, . . ., d) are provided for enhanced security. Therefore, at the cost ofreduced security, dimensions u_(t), w_(t), and z_(t) (t=0, . . . , d)may be omitted by setting u_(t), w_(t), and z_(t) (t=0, . . . , d)respectively to 0.

In the above description, 1+u₀+1+w₀+z₀ is set in N₀, andn_(t)+u_(t)+w_(t)+z_(t) is set in N_(t). However, 1+u₀+1+w₀+z₀ may bereplaced with 1+1+1+1+1 so that 5 is set in N₀, andn_(t)+u_(t)+w_(t)+z_(t) may be replaced with n_(t)+n_(t)+n_(t)+1 so that3n_(t)+1 is set in N_(t).

In this case, the Setup algorithm shown in Formula 132 is rewritten asshown in Formula 154. G_(ob) is rewritten as shown in Formula 155.

$\begin{matrix}{{Setup}\left( {1^{\lambda},{\overset{->}{n}:={\left( {{d;n_{1}},\ldots \mspace{14mu},n_{d}} \right):{{\left( {{param}_{\overset{->}{n}},\left\{ {_{t},_{t}^{*}} \right\}_{{t = 0},\mspace{11mu} \ldots \mspace{14mu},d}} \right)\overset{R}{}_{ob}}\left( {1^{\lambda},\overset{->}{n}} \right)}}},} \right.} & \left\lbrack {{Formula}\mspace{14mu} 154} \right\rbrack \\{{{\hat{}}_{0}:=\left( {b_{0,1},b_{0,3},b_{0,5}} \right)},{{\hat{}}_{t}:={{\left( {b_{t,1},\ldots \mspace{14mu},b_{t,n_{t}},b_{t,{{3n_{t}} + 1}}} \right)\mspace{79mu} {for}\mspace{79mu} t} = 1}},\ldots \mspace{14mu},d,\mspace{79mu} {{\hat{}}_{0}^{*}:=\left( {b_{0,1}^{*},b_{0,3}^{*}} \right)},{{\hat{}}_{t}^{*}:={{\left( {b_{t,1}^{*},\ldots \mspace{14mu},b_{t,n_{t}}^{*}} \right)\mspace{79mu} {for}\mspace{79mu} t} = 1}},\ldots \mspace{14mu},d,} & \; \\{{{pk}:=\left( {1^{\lambda},{param}_{\overset{->}{n}},\left\{ {\hat{}}_{t} \right\}_{{t = 0},\mspace{11mu} \ldots \mspace{14mu},d},b_{0,4}^{*},\left\{ {b_{t,{{2n_{t}} + 1}}^{*},\ldots \mspace{14mu},b_{t,{3n_{t}}}^{*}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d}} \right)},} & \; \\{\; {{{sk}:=\left\{ {\hat{}}_{t}^{*} \right\}_{{t = 0},\mspace{11mu} \ldots \mspace{14mu},d}},\mspace{79mu} {{return}\mspace{14mu} {pk}},{{sk}.}}} & \; \\{\; {{{{_{ob}\left( {1^{\lambda},{\overset{->}{n}:=\left( {{d;n_{1}},\ldots \mspace{14mu},n_{d}} \right)}} \right)}:\mspace{79mu} N_{0}}:=5},{N_{t}:={{3n_{t}} + {1\mspace{14mu} \left( {{t - 1},\ldots \mspace{14mu},d} \right)}}},\mspace{79mu} {{param}_{}:={\left( {q,,_{T},g,e} \right)\overset{R}{}{_{bpg}\left( 1^{\lambda} \right)}}},\mspace{79mu} {\psi \overset{U}{}_{q}^{x}},\mspace{79mu} {{{For}\mspace{14mu} t} = 0},\ldots \mspace{14mu},d,}} & \left\lbrack {{Formula}\mspace{14mu} 155} \right\rbrack \\{{{param}_{_{t}}:={\left( {q,_{t},_{T},_{t},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t},{param}_{}} \right)}}},} & \; \\{{X_{t}:={\left( \chi_{t,i,j} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t},_{q}} \right)}}},{\left( v_{t,i,j} \right)_{i,j}:={\psi \cdot \left( X_{t}^{T} \right)^{- 1}}},} & \; \\{{b_{t,i}:={\left( {{\chi_{t,i,1,}\mspace{14mu} \ldots}\mspace{14mu},\chi_{t,i,N_{t}}} \right)_{_{t}} = {\sum\limits_{j = 1}^{N_{t}}{\chi_{t,i,j}a_{t,j}}}}},{_{t}:=\left( {b_{t,1},\ldots \mspace{14mu},b_{t,N_{t}}} \right)},} & \; \\{{b_{t,i}^{*}:={\left( {{v_{t,i,1,}\mspace{14mu} \ldots}\mspace{14mu},v_{t,i,N_{t}}} \right)_{_{t}} = {\sum\limits_{j = 1}^{N_{t}}{v_{t,i,j}a_{t,j}}}}},{_{t}^{*}:=\left( {b_{t,1}^{*},\ldots \mspace{14mu},b_{t,N_{t}}^{*}} \right)},} & \; \\{{g_{T}:={e\left( {g,g} \right)}^{\psi}},{{param}_{\overset{->}{n}}:=\left( {\left\{ {param}_{_{t}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d,}g_{T}} \right)}} & \; \\{{return}\mspace{14mu} {\left( {{param}_{\overset{->}{n}},\left\{ {_{t},_{t}^{*}} \right\}_{{t = 0},\mspace{11mu} \ldots \mspace{14mu},d}} \right).}} & \;\end{matrix}$

The KeyGen algorithm shown in Formulas 139 and 140 is rewritten as shownin Formulas 156 and 157.

$\begin{matrix}{{{KeyGen}\left( {{pk},{sk},{\left( {{\overset{->}{v}}_{1},\ldots \mspace{14mu},{\overset{->}{v}}_{L}} \right):=\left( {v_{1,1},\ldots \mspace{14mu},v_{1,n_{1}}} \right)}, \ldots \mspace{14mu},\left( {v_{L,1},\ldots \mspace{14mu},v_{L,n_{L}}} \right)} \right)}:} & \left\lbrack {{Formula}\mspace{14mu} 156} \right\rbrack \\{\mspace{85mu} {{for}\mspace{79mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}\mspace{79mu} {{\tau = {L + 1}},\ldots \mspace{14mu},{d;}}\mspace{79mu} {{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}\mspace{79mu} {\psi,s_{{dec},t},{{{s_{{ran},j,t}\overset{U}{}_{q}}\mspace{14mu} \left( {{t = 1},\ldots \mspace{14mu},L} \right)};}}}} & \; \\{\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{}_{q}},{\overset{->}{\eta}}_{{dec},t},{{{{\overset{->}{\eta}}_{{ran},j,t}\overset{U}{}_{q}^{n_{t}}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)};}} & \; \\{s_{{ran},{({\tau,l})},t},{{s_{{del},{({\tau,l})},t}\overset{U}{}{_{q}\left( {{t = 1},\ldots \mspace{14mu},{L + 1}} \right)}};}} & \; \\{\theta_{{ran},{({\tau,l})},t},{\theta_{{del},{({\tau,l})},t}\overset{U}{}_{q}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},{{\overset{->}{\eta}}_{{del},{({\tau,l})},t}\overset{U}{}_{q}^{n_{t}}},{\left( {{t = 0},\ldots \mspace{14mu},{L + 1}} \right);}} & \; \\{\; {{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},\mspace{11mu} {s_{{ran},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{ran},{({\tau,l})},t}}},{s_{{del},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},{({\tau,l})},t}}},}} & \; \\{{k_{L,{dec}}^{*}:\left( {\left( {{- s_{{dec},0}},0,1,\eta_{{dec},0},0} \right)_{_{0}^{*}},{\left( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{dec},t},0} \right)_{_{t}^{*}}:=1},\ldots \mspace{14mu},L} \right)},} & \left\lbrack {{Formula}\mspace{14mu} 157} \right\rbrack \\{{k_{L,{ran},j}^{*}:=\left( {\left( {{- s_{{ran},j,0}},0,0,\eta_{{ran},j,0},0} \right)_{_{0}^{*}},{{\left( {{{s_{{ran},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},j,t},0} \right)_{_{t}^{*}}:t} = 1},\ldots \mspace{14mu},L} \right)},} & \; \\{{k_{L,{ran},{({\tau,l})}}^{*}:=\left( {\left( {{{- s_{{ran},{({\tau,l})},0}}0},0,\eta_{{ran},{({\tau,l})},0},0} \right)_{_{0}^{*}},{{\left( {{{s_{{ran},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},0} \right)_{_{t}^{*}}:t} = 1}, \ldots \mspace{14mu},{L\left( {{s_{{ran},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{n_{\tau}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},{L + 1}},0} \right)}_{_{\tau}^{*}}} \right)},} & \; \\{{k_{L,{del},{({\tau,l})}}^{*}:=\left( {\left( {{- s_{{del},{({\tau,l})},0}},0,0,\eta_{{del},{({\tau,l})},0},0} \right)_{_{0}^{*}},{{\left( {{{s_{{del},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{del},{({\tau,l})},t},0} \right)_{_{t}^{*}}:t} = 1}, \ldots \mspace{14mu},{L\left( {{{s_{{del},{({\tau,l})},{L = 1}}{\overset{->}{e}}_{\tau,1}} + {\psi \; {\overset{->}{e}}_{\tau,l}}},0^{n_{\tau}},{\overset{->}{\eta}}_{{del},{({\tau,l})},{L + 1}},0} \right)}_{_{\tau}^{*}}} \right)},} & \; \\{{{sk}_{L}:=\left( {k_{L,{dec}}^{*},\left\{ k_{L,{ran},j}^{*} \right\}_{{j = 1},\mspace{11mu} \ldots \mspace{14mu},{2L}},{\left\{ k_{L,{ran},{({\tau,l})}}^{*} \right\}_{{\tau = {L + 1}},\mspace{11mu} {{\ldots \mspace{14mu} d};{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})},}\left\{ k_{L,{del},{({\tau,l})}}^{*} \right\}_{{\tau = {L + 1}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}}}} \right)},} & \; \\{{{return}\mspace{14mu} {{sk}_{L}.}}\mspace{11mu}} & \;\end{matrix}$

The Enc algorithm shown in Formula 144 is rewritten as shown in Formula158.

$\begin{matrix}{{Enc}\left( {{pk},{m \in _{T}},{{\left( {{\overset{->}{x}}_{1},\ldots \mspace{14mu},{\overset{->}{x}}_{L}} \right):={\left( {\left( {x_{1,1},\ldots \mspace{14mu},x_{1,n_{1}}} \right),\ldots \mspace{14mu},\left( {x_{L,1},\ldots \mspace{14mu},x_{L,n_{L}}} \right)} \right):\mspace{79mu} {{\left( {{\overset{->}{x}}_{L + 1},\ldots \mspace{14mu},{\overset{->}{x}}_{d}} \right)\overset{U}{}_{q}^{n_{L + 1}}} \times \ldots \times _{q}^{n_{d}}}}};\mspace{79mu} \omega},\zeta,\phi_{0},\ldots \mspace{14mu},{\phi_{d}\overset{U}{}_{q}},{c_{1}:=\left( {\left( {\omega,0,\zeta,0,\phi_{0}} \right)_{_{0}},{{\left( {{\omega \; {\overset{->}{x}}_{t}},0^{n_{t}},0^{n_{t}},\phi_{t}} \right)_{\; t}:t} = 1},\ldots \mspace{14mu},d} \right)},\mspace{79mu} {c_{2}:={g_{T}^{\zeta}m}},\mspace{79mu} {{ct}:=\left( {c_{1},c_{2}} \right)},\mspace{79mu} {{return}\mspace{14mu} {{ct}.}}} \right.} & \left\lbrack {{Formula}\mspace{14mu} 158} \right\rbrack\end{matrix}$

The Delegate_(L) algorithm shown in Formulas 152 and 153 is rewritten asshown in Formulas 159 and 160.

$\begin{matrix}{{{Delegate}_{L}\left( {{pk},{sk}_{L},{{\overset{->}{v}}_{L + 1}:=\left( {v_{{L + 1},1},\ldots \mspace{14mu},v_{{L + 1},n_{L + 1}}} \right)}} \right)}:} & \left\lbrack {{Formula}\mspace{14mu} 159} \right\rbrack \\{\mspace{85mu} {{for}\mspace{79mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}\mspace{79mu} {{j^{\prime} = 1},{{\ldots \mspace{14mu} 2\left( {L + 1} \right)};}}\mspace{79mu} {{\tau = {L + 2}},\ldots \mspace{14mu},{d;}}\mspace{79mu} {{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}\mspace{79mu} {{t = 0},\ldots \mspace{14mu},{L + 1},{\tau;}}}} & \; \\{\mspace{70mu} {{{\left( {t,i} \right) = \left( {t,1} \right)},\ldots \mspace{14mu},{\left( {t,n_{t}} \right);}}\mspace{79mu} {\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},{\sigma_{{ran},j^{\prime},}\alpha_{{ran},{({\tau,l})},j}},\sigma_{{ran},{({\tau,l})}},\mspace{79mu} \varphi_{{ran},{({\tau,l})}},\alpha_{{del},{({\tau,l})},j},\sigma_{{del},{({\tau,l})}},\varphi_{{del},{({\tau,l})}},\psi^{\prime},\mspace{79mu} \eta_{{dec},{({t,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l})},{({t,i})}},{\eta_{{del},{({\tau,l})},{({t,i})}}\overset{U}{}_{q}},}}} & \; \\{{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\eta_{{dec},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{dec},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}}}},} & \left\lbrack {{Formula}\mspace{14mu} 160} \right\rbrack \\{{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\eta_{{ran},j^{\prime},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}}}},} & \; \\{{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\varphi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\eta_{{ran},{({\tau,l})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}}},} & \; \\{{k_{{L + 1},{del},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\psi^{\prime}k_{L,{del},{({\tau,i})}}^{*}} + {\varphi_{{del},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\eta_{{del},{({\tau,l})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}}},} & \; \\{{{sk}_{L + 1}:=\left( {k_{{L + 1},{dec}}^{*},\left\{ k_{{L + 1},{ran},j^{\prime}}^{*} \right\}_{{j^{\prime} = 1},\mspace{11mu} \ldots \mspace{14mu},{2{({L + 1})}}},\left\{ {k_{{L + 1},{ran},{({\tau,l})}}^{*},k_{{L + 1},{del},{({\tau,l})}}^{*}} \right\}_{{\tau = {L + 2}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}}} \right)},} & \; \\{\mspace{79mu} {{return}\mspace{14mu} {sk}_{L + 1}}} & \;\end{matrix}$

The Dec algorithm shown in Formula 146 remains the same.

The Setup algorithm needs to be executed once when the cryptographicprocessing system 10 is set up, and does not have to be executed eachtime a decryption key is generated. In the above description, the Setupalgorithm and the KeyGen algorithm are executed by the key generationdevice 100. However, the Setup algorithm and the KeyGen algorithm may beexecuted by different devices.

Second Embodiment

In this embodiment, a generalized version of the HPE scheme for innerproducts discussed in the first embodiment will be described.

In the HPE scheme for inner products discussed in the first embodiment,a ciphertext ct can be decrypted by a decryption key, as a general rule,if the inner product of attribute information set in the ciphertext ctand predicate information set in the decryption key is 0.

However, in the HPE scheme for inner products to be discussed in thesecond embodiment, it may be arranged that decryption is possible evenif the inner product of the attribute information set in the ciphertextct and the predicate information set in the decryption key is not 0.

Specifically, in the following description, decryption is possible ifthe inner product of attribute information x{right arrow over ( )}_(t)and predicate information v{right arrow over ( )}_(t) is 0 for eachinteger t of ρ_(t) (t=1, . . . , d) having the value of 0 and if theinner product of the attribute information x{right arrow over ( )}_(t)and the predicate information v{right arrow over ( )}_(t) is not 0 foreach integer t of ρ_(t) (t=1, . . . , d) having the value of 1.

With this arrangement, it is possible to set a positive conditionalexpression (e.g., attribute information=predicate information) or anegative conditional expression (attribute information≠predicateinformation) depending on the setting of the value of ρ_(t) (t=1, . . ., d).

Referring to FIGS. 17 and 19, the HPE scheme for inner productsaccording to the second embodiment will be described, and functions andoperations of the cryptographic processing system 10 that implements theHPE scheme for inner products will be described.

A functional configuration of the cryptographic processing system 10according to the second embodiment is the same as a functionalconfiguration of the cryptographic processing system 10 according to thefirst embodiment shown in FIGS. 8 to 11.

FIG. 17 is a flowchart showing operations of the key generation device100 and showing a process of the KeyGen algorithm. FIG. 18 is aflowchart showing operations of the decryption device 300 and showing aprocess of the Dec algorithm.

FIG. 19 is a flowchart showing operations of the key delegation device400 and showing a process of the Delegate_(L) algorithm.

Processes of the Setup algorithm and the Enc algorithm according to thesecond embodiment are the same as the processes of the Setup algorithmand the Enc algorithm according to the first embodiment, so thatdescription will be omitted. In the Enc algorithm, however, a ciphertextct to be transmitted to the decryption device 300 includes not onlyciphertexts c₁ and c₂ but also attribute information x{right arrow over( )}_(i) (i=1, . . . , L).

Referring to FIG. 17, the process of the KeyGen algorithm executed bythe key generation device 100 will be described.

(S601: Information Input Step)

Using the input device, the information input unit 130 inputs predicateinformation ((v{right arrow over ( )}₁,ρ₁), (v{right arrow over ()}_(L),ρ_(L))):=((v_(1,i) (i=1, . . . , n₁), ρ₁ε{0,1}), . . . , (v_(L,i)(i=1, . . . , n_(L)), ρ_(L)ε{0,1})). As predicate information, anattribute of a user of a key is input.

(S602: Random Number Generation Step)

Using the processing device, the random number generation unit 141generates a random number ψ, random numbers s_(dec,t), s_(ran,j,t) (t=1,. . . , L), random numbers θ_(dec,t), θ_(ran,j,t), η{right arrow over ()}_(dec,t), η{right arrow over ( )}_(ran,j,t), η{right arrow over ()}_(ran,0,t), η{right arrow over ( )}_(del,0,t), η{right arrow over ()}_(del,1,t) (t=0, . . . , L), random numbers s_(ran,0,t), s_(del,0,t),s_(del,1,t) (t=0, . . . , L+1), random numbers θ_(ran,0,t), θ_(del,0,t),θ_(del,1,t) (t=0, . . . , L+1), and random numbers η{right arrow over ()}_(ran,(τ,ι)), η{right arrow over ( )}_(del,0,(τ,ι)), η{right arrowover ( )}_(del,1,(τ,ι)) for each of integers j, τ, ι of j=1, . . . , 2L,τ=L+1, . . . , d, (τ,ι)=(τ,1), . . . , (τ,n_(τ)), as shown in Formula161.

$\begin{matrix}{\mspace{79mu} {{{for}\mspace{79mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}}\mspace{79mu} {{\tau = {l + 1}},\ldots \mspace{14mu},{d;}}\mspace{79mu} {{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}\mspace{79mu} {\psi,s_{{dec},t},{{s_{{ran},j,t}\overset{U}{}_{q}}\mspace{14mu} \left( {{t = 1},\ldots \mspace{14mu},L} \right)},\mspace{79mu} \theta_{{dec},t},{{\theta_{{ran},j,t}\overset{U}{}_{q}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)},{{\overset{->}{\eta}}_{{dec},t}:={{\left( {\eta_{{dec},t,1},\ldots \mspace{14mu},\eta_{{dec},t,w_{t}}} \right)\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)}},{{\overset{->}{\eta}}_{{ran},j,t}:={{\left( {\eta_{{ran},j,t,1},\ldots \mspace{14mu},\eta_{{ran},j,t,w_{t}}} \right)\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)}},{{\overset{->}{\eta}}_{{ran},0,t}:={{\left( {\eta_{{ran},0,t,1},\ldots \mspace{14mu},\eta_{{ran},0,t,w_{t}}} \right)\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)}},{{\overset{->}{\eta}}_{{del},0,t}:={{\left( {\eta_{{del},0,t,1},\ldots \mspace{14mu},\eta_{{del},0,t,w_{t}}} \right)\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)}},{{\overset{->}{\eta}}_{{del},1,t}:={{\left( {\eta_{{del},1,t,1},\ldots \mspace{14mu},\eta_{{del},1,t,w_{t}}} \right)\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)}},\mspace{79mu} s_{{ran},0,t},s_{{del},0,t},{{s_{{del},1,t}\overset{U}{}_{q}}\mspace{14mu} \left( {{t = 1},\ldots \mspace{14mu},{L + 1}} \right)},\mspace{79mu} \theta_{{ran},0,t},\theta_{{del},0,t},{{\theta_{{del},1,t}\overset{U}{}_{q}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},{L + 1}} \right)},\mspace{79mu} {{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}}:={\left( {\eta_{{ran},0,{({\tau,l})},1},\ldots \mspace{14mu},\eta_{{ran},0,{({\tau,l})},w_{l}}} \right)\overset{U}{}_{q}^{w_{t}}}},\mspace{79mu} {{\overset{->}{\eta}}_{{del},0,{({\tau,l})}}:={\left( {\eta_{{del},0,{({\tau,l})},1},\ldots \mspace{14mu},\eta_{{del},0,{({\tau,l})},w_{t}}} \right)\overset{U}{}_{q}^{w_{t}}}},\mspace{79mu} {{\overset{->}{\eta}}_{{del},1,{({\tau,l})}}:={\left( {\eta_{{del},1,{({\tau,l})},1},\ldots \mspace{14mu},\eta_{{del},1,{({\tau,l})},w_{l}}} \right)\overset{U}{}_{q}^{w_{t}}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 161} \right\rbrack\end{matrix}$

s_(dec,0), s_(ran,j,0), s_(ran,0,0), s_(del,0,0), and s_(del,1,0) areset as shown in Formula 162.

s _(dec,0):=Σ_(t=1) ^(L) s _(dec,t),

s _(ran,j,0):=Σ_(t=1) ^(L) s _(ran,j,t),

s _(ran,0,0):=Σ_(r=1) ^(L) s _(ran,0,t),

s _(del,0,0):=Σ_(t=1) ^(L+1) s _(del,0,t),

s _(del,1,0):=Σ_(t=1) ^(L+1) ^(s) _(del,1,t)  [Formula 162]

(S603: Decryption Element Generation Step)

Using the processing device, the decryption element generation unit 142generates a decryption element _(k*L,dec) which is an element of adecryption key sk_(L), as shown in Formula 163.

k L , dec * := ( ( - s dec , 0 , 0 u 0 , 1 , η → dec , 0 , 0 z 0 ) , { (s dec , t  e → t , 1 + θ dec , t ,  v → t , 0 u t , η → dec , t , 0 zt ) t * , if   ρ t = 0 ( s dec , t  v → t , 0 u t , η → dec , t , 0 zt ) t * , if   ρ t = 1 } : t = 1 , …  , L ) [ Formula   163 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 163 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the decryption elementk*_(L,dec).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(dec,0) is set as a coefficient of a basis vector 1 of the basis B*₀.0 is set as a coefficient of each of basis vectors 1+1, . . . , 1+u₀. 1is set as a coefficient of a basis vector 1+u₀+1. η_(dec,0,1), . . . ,η_(dec,0,w0) (where w0 denotes w₀) are respectively set as coefficientsof basis vectors 1+u₀+1+1, . . . , 1+u₀+1+w₀. 0 is set as a coefficientof each of basis vectors 1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) varydepending on whether the value of ρ_(t) is 0 or 1.

When the value of ρ_(t) is 0, s_(dec,t)+θ_(dec,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(dec,t)v_(t,2), . . . , θ_(dec,t)v_(t,nt) (where nt denotes n_(t)) arerespectively set as coefficients of basis vectors 2, . . . , n_(t). 0 isset as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(dec,t,1), . . . , η_(dec,t,wt) (where wt denotes w_(t))are respectively set as coefficients of basis vectors n_(t)+u_(t)+1, . .. , n_(t)+u_(t)+w_(t). 0 is set as a coefficient of each of basisvectors n_(t)+u_(t)+w_(t)+1, . . . , n_(t)+u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(dec,t)v_(t,1), . . ., s_(dec,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 1, . . . , n_(t) of the basis B*_(t) (t=1,. . . , L). 0 is set as a coefficient of each of basis vectors n_(t)+1,. . . , n_(t)+u_(t). η_(dec,t,1), . . . , η_(dec,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

(S604: First Randomizing Element Generation Step)

Using the processing device, the randomizing element generation unit 143generates a first randomizing element k*_(L,ran,j) which is an elementof the decryption key sk_(L), for each integer j of j=1, . . . , 2L, asshown in Formula 164.

k L , ran , j * := ( ( - s ran , j , 0 , 0 u 0 , 0 , η → ran , j , 0 , 0z 0 ) , { ( s ran , j , t  e → t , 1 + θ ran , j , t ,  v → t , 0 u t, η → ran , j , t , 0 z t ) t * , if   ρ t = 0 ( s ran , j , t  v → t, 0 u t , η → ran , j , t , 0 z t ) t * , if   ρ t = 1  }  : t = 1 ,…  , L ) [ Formula   164 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 164 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the first randomizing elementk*_(L,ran,j).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(ran,j,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(ran,j,0,1), . . . , η_(ran,j,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1),b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) vary dependingon whether the value of ρ_(t) is 0 or 1.

When the value of ρ_(t) is 0, s_(ran,j,t)+θ_(ran,j,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(ran,j,t)v_(t,2), . . . , θ_(ran,j,t)v_(t,nt) (where nt denotes n_(t))are respectively set as coefficients of basis vectors 2, . . . , n_(t).0 is set as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(ran,j,t,1), . . . , η_(ran,j,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(ran,j,t)v_(t,1), . .. , s_(ran,j,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 1, . . . , n_(t) of the basis B*_(t) (t=1,. . . , L). 0 is set as a coefficient of each of basis vectors n_(t)+1,. . . , n_(t)+u_(t). η_(ran,j,t,1), . . . , η_(ran,j,t,wt) (where wtdenotes w_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

(S605: Second Randomizing Element Generation Step)

Using the processing device, the randomizing element generation unit 143generates a second randomizing element k*_(L,ran,(τ,ι,0)) which is anelement of the decryption key sk_(L), for each integer τ of τ=L+1, . . ., d and each integer ι of ι=n_(τ) with respect to each integer τ, asshown in Formula 165.

k L , ran , ( τ , ι , 0 ) * := ( ( - s ran , 0 , 0 , 0 u 0 , 0 , η → ran, 0 , 0 , 0 z 0 ) 0 * , { ( s ran , 0 , t  e → t , 1 + θ ran , 0 , t , v → t , 0 u t , η → ran , 0 , t , 0 z t ) t * , if   ρ t = 0 ( s ran, 0 , t  v → t , 0 u t , η → ran , 0 , t , 0 z t ) t * , if   ρ t = 1 }  : t = 1 , …  , L ) ,   ( s ran , 0 , L + 1   → τ , 1 , 0 u τ, η → ran , 0 , ( τ , ι ) , 0 z τ ) τ * ) [ Formula   165 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 165 denotes that coefficientsof basis vectors of the basis B*₀, the basis B*_(t) (t=1, . . . , L) andthe basis B*_(τ) are set as described below to generate the secondrandomizing element k*_(L,ran,(τ,ι,0)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), b*_(0,3).

−s_(ran,0,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(ran,0,0,1), . . . , η_(ran,0,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,i). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) varydepending on whether the value of ρ_(t) is 0 or 1.

When the value of ρ_(t) is 0, s_(ran,0,t)+θ_(ran,0,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(ran,0,t)v_(t,2), . . . , θ_(ran,0,t)v_(t,nt) (where nt denotes n_(t))are respectively set as coefficients of basis vectors 2, . . . , n_(t).0 is set as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(ran,0,t,1), . . . , η_(ran,0,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(ran,0,t)v_(t,1), . .. , s_(ran,0,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 1, . . . , n_(t) of basis B*_(t) (t=1, . .. , L). 0 is set as a coefficient of each of basis vectors n_(t)+1, . .. , n_(t)+u_(t). η_(ran,0,t,1), . . . , η_(ran,0,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τt,1), b*_(τ,3).

s_(ran,0,L+1) is set as a coefficient of a basis vector 1 of the basisB*_(τ). 0 is set as a coefficient of each of basis vectors 2, . . . ,n_(τ), . . . , n_(τ)+u_(τ). η_(ran,0,(τ,ι),1), . . . ,η_(ran,0,(τ,ι)s,wτ) (where wτ denotes w_(τ)) are respectively set ascoefficients of basis vectors n_(τ)+u_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ).0 is set as a coefficient of each of basis vectors n_(τ)+u_(τ)+w_(τ)+1,. . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S606: First Delegation Element Generation Step)

Using the processing device, the delegation element generation unit 144generates a first delegation element k*_(L,del,(τ,ι,0)) which is anelement of the decryption key sk_(L), for each integer τ of τ=L+1, . . ., d and each integer ι of ι=1, . . . , n_(τ) with respect to eachinteger τ, as shown in Formula 166.

k L , del , ( τ , ι , 0 ) * := ( ( - s del , 0 , 0 , 0 u 0 , 0 , η → del, 0 , 0 , 0 z 0 ) 0 * , { ( s del , 0 , t  e → t , 1 + θ del , 0 , t , v → t , 0 u t , η → del , 0 , t , 0 z t ) t * , if   ρ t = 0 ( s del, 0 , t  v → t , 0 u t , η → del , 0 , t , 0 z t ) t * , if   ρ t = 1 }  : t = 1 , …  , L ) ,   ( s del , 0 , L + 1  e → τ , 1 , + ψ  e → τ , ι , 0 u τ , η → del , 0 , ( τ , ι ) , 0 z τ ) τ * ) [ Formula  166 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 166 denotes that coefficientsof basis vectors of the basis B*₀, the basis B*_(t) (t=1, . . . , L),and the basis B*_(τ) are set as described below to generate the firstdelegation element k*_(L,del,(τ,ι,0)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), b*_(0,3).

−s_(del,0,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(del,0,0,1), . . . , η_(del,0,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) varydepending on whether the value of ρ_(t) is 0 or 1.

When the value of ρ_(t) is 0, s_(del,0,t)+θ_(del,0,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(del,0,t)v_(t,2), . . . , θ_(del,0,t)v_(t,nt) (where nt denotes n_(t))are respectively set as coefficients of basis vectors 2, . . . , n_(t).0s is set as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(del,0,t,1), . . . , η_(del,0,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)±u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(del,0,t)v_(t,1), . .. , s_(del,0,t,)v_(t,nt) (where nt denotes n_(t)) are respectively setas coefficients of basis vectors 1, . . . , n_(t) of the basis B*_(t)(t=1, . . . , L). 0 is set as a coefficient of each of basis vectorsn_(t)+1, . . . , n_(t)+u_(t). η_(del,0,t,1), . . . , η_(del,0,t,wt)(where wt denotes w_(t)) are respectively set as coefficients of basisvectors n_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as acoefficient of each of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τ,1), . . . ,b*_(τ,3).

s_(del,0,L+1)e{right arrow over ( )}_(τ,1)+ψe{right arrow over ()}_(τ,ι) is set as a coefficient of basis vectors 1, . . . , n_(τ) ofthe basis B*_(τ). 0 is set as a coefficient of each of basis vectorsn_(τ)+1, . . . , n_(τ)+u_(τ). η_(del,0,(τ,ι),1), . . . ,η_(del,0,(τ,ι),wτ) (where wτ denotes w_(τ)) are respectively set ascoefficients of basis vectors n_(τ)+u_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ).0 is set as a coefficient of each of basis vectors n_(τ)+u_(τ)+w_(τ)+1,. . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S607: Second Delegation Element Generation Step)

Using the processing device, the delegation element generation unit 144generates a second delegation element k*_(L,del,(τ,ι,1)) which is anelement of the decryption key sk_(L), for each integer τ of τ=L+1, . . ., d and each integer ι of ι=1, . . . , n_(τ) with respect to eachinteger τ, as shown in Formula 167.

k L , del , ( τ , ι , 1 ) * := ( ( - s del , 1 , 0 , 0 u 0 , 0 , η → del, 1 , 0 , 0 z 0 ) 0 * , { ( s del , 1 , t  e → t , 1 + θ del , 1 , t , v → t , 0 u t , η → del , 1 , t , 0 z t ) t * , if   ρ t = 0 ( s del, 1 , t  v → t , 0 u t , η → del , 1 , t , 0 z t ) t * , if   ρ t = 1 }  : t = 1 , …  , L ) ,   ( s del , 1 , L + 1  e → τ , ι , 0 u τ, η → del , 1 , ( τ , ι ) , 0 z τ ) τ * ) [ Formula   167 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 167 denotes that coefficientsof basis vectors of the basis B*₀, the basis B*_(t) (t=1, . . . , L) andthe basis B*_(τ) are set as described below to generate the seconddelegation element k*_(L,del,(τ,ι,1)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(del,1,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(del,1,0,1), . . . , η_(del,1,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denotes basis vectors b*_(t,1), . .. , b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) varydepending on whether the value of ρ_(t) is 0 or 1.

When the value ρ_(t) is 0, s_(del,1,t)+θ_(del,1,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(del,1,t)v_(t,2), . . . , θ_(del,1,t)v_(t,nt) (where nt denotes n_(t))are respectively set as coefficients of basis vectors 2, . . . , n_(t).0 is set as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(del,1,t,1), . . . , η_(del,1,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(del,1,t)v_(t,1), . .. , s_(del,1,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 1, . . . , n_(t) of the basis B*_(t) (t=1,. . . , L). 0 is set as a coefficient of each of basis vectors n_(t)+1,n_(t)+u_(t). η_(del,1,t,1), . . . , η_(del,1,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(i)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τ,1), . . . ,b*_(τ,3).

s_(del,1,L+1)e{right arrow over ( )}_(τ,ι) is set as a coefficient ofbasis vectors 1, . . . , n_(τ) of the basis B*_(τ). 0 is set as acoefficient of each of basis vectors n_(τ)+1, . . . , n_(τ)+u_(τ).η_(del,1,(τ,ι),1,), . . . , η_(del,1,(τ,ι),wτ) (where wτ denotes w_(τ))are respectively set as coefficients of basis vectors n_(τ)+u_(τ)+1, . .. , n_(τ)+u_(τ)+w_(τ). 0 is set as a coefficient of each of basisvectors n_(τ)+u_(τ)+w_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S608: Key Distribution Step)

Using the communication device and through the network, for example, thekey distribution unit 150 secretly provides to the decryption device 300the decryption key sk_(L) having elements of the decryption elementk*_(L,dec), the first randomizing element k*_(L,ran,j) (j=1, . . . ,2L), the second randomizing element k*_(L,ran,(τ,ι,0)) (τ=L+1, . . . ,d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))), the first delegation elementk*_(L,del,(τ,ι,0)) (τ=L+1, . . . , d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))),and the second delegation element k*_(L,del,(τ,ι,1)) (τ=L+1, . . . , d;(τ,ι)=(τ,1), . . . , (τ,n_(τ))). It is obvious that the decryption keysk_(L) may be provided to the decryption device 300 by other methods.

To summarize, in (S601) to (S607), the key generation device 100executes the KeyGen algorithm shown in Formulas 168 and 169, andgenerates the decryption key sk_(L). Then, in (S608), the key generationdevice 100 provides the generated decryption key sk_(L) to thedecryption device 300.

KeyGen  ( p   k , sk , ( v → 1 , ρ 1 ) , …  , ( v → L , ρ L ) ) := (( ( v 1  , 1 , …  , v 1  , n 1 ) ∈ q n 1 , ρ 1 ∈ { 0 , 1 } ) , …  ,( ( v L  , 1 , …  , v L  , n L ) ∈ q n L , ρ L ∈ { 0 , 1 } ) ) : [Formula   168 ] for   j = 1 , …  , 2  L ; τ = L + 1  …  , d ; (τ , ι ) = ( τ , 1 ) , …  , ( τ , n τ ) ; ψ , s dec , t , s ran , j , t  U  q  ( t = 1 , …  , L ) ;    θ dec , t , θ ran . j , t   U q ,   η → dec , t , η → ran , j , t , η → ran , 0 , t , η → del , 0, t  η → del , 1 , t   U  q w t  ( t = 0 , …  , L ) ;    s ran, 0 , t , s del , 0 , t , s del , 1 , t   U  q ,   θ ran , 0 , t ,θ del , 0 , t , θ del , 1 , t   U  q , η → ran , 0 , ( τ , ι ) , η →del , 0 , ( τ , ι ) , η → del , 1 , ( τ , ι )   U  q w t ,   ( t =0 , …  , L + 1 ) ; s dec , 0 := ∑ t = 1 L  s dec , t , s ran , j , 0:= ∑ t = 1 L  s ran , j , t ,   s ran , 0 , 0 := ∑ t = 1 L  s ran ,0 , t , s del , 0 , 0 := ∑ t = 1 L + 1  s del , 0 , t , s del , 1 , 0:= ∑ t = 1 L + 1   s del , 1 , t , k L , dec * := ( ( - s dec , 0 , 0u 0 , 1 , η → dec , 0 , 0 z 0 ) , { ( s dec , t  e → t , 1 + θ dec , t,  v → t , 0 u t , η → dec , t , 0 z t ) t * , if   ρ t = 0 ( s dec ,t  v → t , 0 u t , η → dec , t , 0 z t ) t * if   ρ t = 1 } : t = 1 ,…  , L ) k L , ran , j * := ( ( - s ran , j , 0 , 0 u 0 , 0 , η → ran ,j , 0 , 0 z 0 ) , { ( s ran , j , t  e → t , 1 + θ ran , j , t ,  v →t , 0 u t , η → ran , j , t , 0 z t ) t * , if   ρ t = 0 ( s ran , j ,t  v → t , 0 u t , η → ran , j , t , 0 z t ) t * if   ρ t = 1  }  :t = 1 , …  , L ) k L , ran , ( τ , ι , 0 ) * := ( ( - s ran , 0 , 0 , 0u 0 , 0 , η → ran , 0 , 0 , 0 z 0 ) 0 * , { ( s ran , 0 , t  e → t ,1 + θ ran , 0 , t ,  v → t , 0 u t , η → ran , 0 , t , 0 z t ) t * , if  ρ t = 0 ( s ran , 0 , t  v → t , 0 u t , η → ran , 0 , t , 0 z t )t * , if   ρ t = 1  }  : t = 1 , …  , L ) , [ Formula   169 ] ( sran , 0 , L + 1   → τ , 1 , 0 u τ , η → ran , 0 , ( τ , ι ) , 0 z τ )τ * ) , k L , del , ( τ , ι , 1 ) * := ( ( - s del , 1 , 0 , 0 u 0 , 0 ,η → del , 1 , 0 , 0 z 0 ) 0 * , { ( s del , 1 , t  e → t , 1 + θ del ,1 , t ,  v → t , 0 u t , η → del , 1 , t , 0 z t ) t * , if   ρ t = 0( s del , 1 , t  v → t , 0 u t , η → del , 1 , t , 0 z t ) t * , if  ρ t = 1  }  : t = 1 , …  , L ) , ( s del , 1 , L + 1  e → τ , ι , 0u τ , η → del , 1 , ( τ , ι ) , 0 z τ ) τ * ) ,   sk L + 1 := ( ( ( v→ 1 , ρ 1 ) , …  , ( v → L , ρ L ) ) ;   k L , dec * , { k L , ran ,j * } j = 1 , …  , 2  ( L ) , { k L , ran , ( τ , ι , 0 ) * , k L ,del , ( τ , ι , 0 ) * ,   k L , del , ( τ , ι , 1 ) * } τ = L + 1 , … , d ; ( τ , ι ) = ( τ , 1 ) , …  , ( τ , n τ ) ) , return   sk L .

Referring to FIG. 18, the process of the Dec algorithm executed by thedecryption device 300 will be described.

(S701: Decryption Key Acquisition Step)

Using the communication device and through the network, for example, thedecryption key acquisition unit 310 obtains the decryption key sk_(L).The decryption key acquisition unit 310 also obtains the publicparameter pk generated by the key generation device 100.

(S702: Data Receiving Step)

Using the communication device and through the network, for example, thedata receiving unit 320 receives the ciphertext ct transmitted by theencryption device 200.

(S703: Pairing Operation Step)

Using the processing device, the pairing operation unit 330 performs apairing operation shown in Formula 170, and computes a session keyK=g_(T) ^(ζ).

$\begin{matrix}{K:={{e\left( {c_{1,0},k_{L,{dec},0}^{*}} \right)} \cdot {\prod\limits_{{1 \leq t \leq {d\bigwedge\rho_{t}}} = 0}\; {{e\left( {c_{1,t},k_{L,{dec},t}^{*}} \right)} \cdot {\prod\limits_{{1 \leq t \leq {d\bigwedge\rho_{t}}} = 1}\; {e\left( {c_{1,t},k_{L,{dec},t}^{*}} \right)}^{1/{({{\overset{\rightarrow}{v}}_{t} \cdot {\overset{\rightarrow}{x}}_{t}})}}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 170} \right\rbrack\end{matrix}$

Here, Formula 171 is defined.

(k* _(L,dec,0)ε

, . . . , k*_(L,dec,d)ε

):=k* _(L,dec), (c _(1,0)ε

, . . . , c_(1,d)ε

:=c₁  [Formula 171]

The session key K is computed by computing Formula 170 if the innerproduct of v{right arrow over ( )}_(t) and x{right arrow over ( )}_(t)is 0 for each integer t of ρ_(t)=0 and if the inner product of v{rightarrow over ( )}_(t) and x{right arrow over ( )}_(t) is not 0 for eachinteger t of ρ_(t)=1 with respect to each integer t of t=1, . . . , L.

(S704: Message Computation Step)

Using the processing device, the message computation unit 340 dividesthe ciphertext c2 by the session key K, and thereby computes a messagem′ (=m).

To summarize, in (S701) to (S704), the decryption device 300 executesthe Dec algorithm shown in Formula 172, and computes the message m′(=m).

 Dec  ( p   k , sk L , ct )  :   K := e  ( c 1 , 0  k L , dec ,0 * ) · ∏ 1 ≤ t ≤ d ⋀ ρ t = 0   e  ( c 1 , t , k L , dec , t * ) · ∏1 ≤ t ≤ d ⋀ ρ t = 1   e  ( c 1 , t , k L , dec , t * ) 1 / ( v → t ·x → t ) ,   where   ( k L , dec , 0 * ∈ 〈 0 * 〉 , …  , k L , dec, d * ∈ 〈 d * 〉 ) := k L , dec * ,   ( c 1 , 0 ∈ 〈 0 * 〉 , …  , c1 , d ∈ 〈 d * 〉 ) := c 1 ,   m ′ := c 2 / K ,   return   m ′ . [Formula   172 ]

Referring to FIG. 19, the process of the Delegate_(L) algorithm executedby the key delegation device 400 will be described.

(S801: Decryption Key Acquisition Step)

Using the communication device and through the network, for example, thedecryption key acquisition unit 410 obtains the decryption key sk_(L).The decryption key acquisition unit 410 also obtains the publicparameter pk generated by the key generation device 100.

(S802: Information Input Step)

Using the input device, the information input unit 420 inputs predicateinformation (v{right arrow over ( )}_(L+1), ρ_(L+1)):=(v_(L+1,i) (i=1, .. . , n_(L+1)), ρ_(L+1)ε{0,1}). As predicate information, an attributeof a person to whom the key is delegated is input.

(S803: Random Number Generation Step)

Using the processing device, the random number generation unit 431generates random numbers α_(dec,j), σ_(dec), α_(ran,j′,j), σ_(ran,j′),α_(ran,(τ,ι,0),j), σ_(ran,(τ,ι,0)), φ_(ran,(τ,ι,0)), α_(del,(τ,ι,0),j),σ_(del,(τ,ι,0)), φ_(del,(τ,ι,0)), α_(del,(τ,ι,1),j), σ_(del,(τ,ι,1)),φ_(del,(τ,ι,1)), η_(dec,(t,i)), η_(ran,j′,(t,i)), η_(ran,(τ,ι,0),(t,i)),η_(del,(τ,ι,0),(t,i)), η_(del,(τ,ι,1),(t,i)), ψ₀, ψ₁, for each integerj, j′, τ, ι, t, i of j=1, . . . , 2L, j′=1, . . . , 2(L+1), τ=L+2, . . ., d, (τ,ι)=(τ,1), . . . , (τ,n_(τ)), t=0, . . . , L+1, τ, (t,i)=(t,1), .. . , (t,n_(t)), as shown in Formula 173.

for   j = 1 , …  , 2  L ; j ′ = 1 , …  , 2  ( L + 1 ) ;   τ =L + 2 , …  , d ; ( τ , ι ) = ( τ , 1 ) , …  , ( τ , n τ ) ;   t = 0, …  , L + 1 , τ ; ( t , i ) = ( t = 1 ) , …  , ( t , w t ) ;   αdec , j , σ dec , α ran , j ′ , j , σ ran , j ′ , α ran , ( τ , ι , 0 ), j ,  σ ran , ( τ , ι , 0 ) , φ ran , ( τ , ι , 0 ) , α del , ( τ , ι, 0 ) , j , σ del , ( τ , ι , 0 ) ,  φ del , ( τ , ι , 0 ) , α del , (τ , ι , l ) , j , σ del , ( τ , ι , 1 ) , φ del , ( τ , ι , l ) ,  ηdec , ( t , i ) , η ran , j ′ , ( t , i ) , η ran , ( τ , ι , 0 ) , ( t, i ) , η del , ( τ , ι , 0 ) , ( t , i ) ,  η del , ( τ , ι , 1 ) , (t , i ) , ψ 0 , ψ 1 ,  U  q [ Formula   173 ]

(S804: Lower-Level Decryption Element Generation Step)

Using the processing device, the lower-level decryption elementgeneration unit 432 generates a lower-level decryption elementk*_(L+1,dec) which is an element of a delegation key sk_(L+1), as shownin Formula 174.

$\begin{matrix}{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}\left( {\sigma_{dec}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} \right. & {{{if}\mspace{14mu} \rho_{t}} = 0} \\\left( {\sigma_{dec}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} +} \right.} \right. & {{{if}\mspace{14mu} \rho_{t}} = 1} \\\left. {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}} \right) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 174} \right\rbrack\end{matrix}$

(S805: First Lower-Level Randomizing Element Generation Step)

Using the processing device, the lower-level randomizing elementgeneration unit 433 generates a first lower-level randomizing elementk*_(L+1,ran,j′) which is an element of the delegation key sk_(L+1), foreach integer j′ of j′=1, . . . , 2(L+1), as shown in Formula 175.

$\begin{matrix}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}{\sigma_{{ran},j^{\prime}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{ran},j^{\prime}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} +} \right.} & {{{if}\mspace{14mu} \rho_{t}} = 1} \\\left. {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}} \right) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 175} \right\rbrack\end{matrix}$

(S806: Second Lower-Level Randomizing Element Generation Step)

Using the processing device, the lower-level randomizing elementgeneration unit 433 generates a second lower-level randomizing elementk*_(L+1,ran,(τ,ι)) which is an element of the delegation key sk_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 176.

$\begin{matrix}{k_{{L + 1},{ran},{({\tau,\iota,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{{({\tau,\iota})}j},}k_{L,{ran},j}^{*}}} + {\varphi_{{ran},{({\tau,\iota,0})}}k_{L,{ran},{({\tau,\iota,0})}}^{*}} + \begin{Bmatrix}{\sigma_{{ran},{({\tau,\iota,0})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{ran},{({\tau,\iota,0})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} +} \right.} & {{{if}\mspace{14mu} \rho_{t}} = 1} \\\left. {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}} \right) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,\iota,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \left\lbrack {{Formula}\mspace{14mu} 176} \right\rbrack\end{matrix}$

(S807: First Lower-Level Delegation Element Generation Step)

Using the processing device, the lower-level delegation elementgeneration unit 434 generates a first lower-level delegation elementk*_(L+1,del,(τ,ι,0)) which is an element of the delegation key sk_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 177.

$\begin{matrix}{k_{{L + 1},{del},{({\tau,\iota,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,\iota,0})},j}k_{L,{ran},j}^{*}}} + {\varphi_{{del},{({\tau,\iota,0})}}k_{L,{{ran}{({\tau,\iota,0})}}}^{*}} + {\psi_{0}k_{L,{{del}{({\tau,\iota,0})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,\iota,0})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{del},{({\tau,\iota,0})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} +} \right.} & {{{if}\mspace{14mu} \rho_{t}} = 1} \\\left. {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}} \right) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,\iota,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \left\lbrack {{Formula}\mspace{14mu} 177} \right\rbrack\end{matrix}$

(S808: Second Lower-Level Delegation Element Generation Step)

Using the processing device, the lower-level delegation elementgeneration unit 434 generates a second lower-level delegation elementk*_(L+1,del,(τ,ι,1)) which is an element of the delegation key sk_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 178.

$\begin{matrix}{k_{{L + 1},{del},{({\tau,\iota,1})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{{del}{({\tau,\iota,1})}},j}k_{L,{ran},j}^{*}}} + {\psi_{1}k_{L,{{del}{({\tau,\iota,1})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,\iota,1})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{del},{({\tau,\iota,1})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} +} \right.} & {{{if}\mspace{14mu} \rho_{t}} = 1} \\\left. {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}} \right) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,1})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,1})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,\iota,1})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \left\lbrack {{Formula}\mspace{14mu} 178} \right\rbrack\end{matrix}$

(S809: Key Distribution Step)

Using the communication device and through the network, for example, thekey distribution unit 150 secretly provides to the lower-leveldecryption device 300 the delegation key sk_(L+1) having elements of thelower-level decryption element k*_(L+1,dec), the first lower-levelrandomizing element k*_(L+1,ran,j′) (j′=1, . . . , 2(L+1)), the secondlower-level randomizing element k*_(L+1,ran,(τ,ι,0))(τ=L+2, . . . , d;(τ,ι)=(τ,1), . . . , (τ,n_(τ))), the first lower-level delegationelement k*_(L+2,del,(τ,ι,0)) (τ=L+2, . . . , d; (τ,ι)=(τ,1), . . . ,(τ,n_(τ))), and the second lower-level delegation elementk*_(L+2,del,(τ,ι,1))(τ=L+2, . . . , d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))).It is obvious that the delegation key sk_(L+1) may be provided to thelower-level decryption device 300 by other methods.

To summarize, in (S501) to (S507), the key delegation device 400executes the Delegate_(L) algorithm shown in Formulas 179 and 180, andgenerates the delegation key sk_(L+1). Then, in (S508), the keydelegation device 400 provides the generated delegation key sk_(L+1) tothe lower-level decryption device 300.

Delegate L  ( p   k , sk L , ( v → L + 1 , ρ L + 1 ) := ( ( v L + 1 ,1 , …  , v L + 1 , n L + 1 ) , ρ L + 1 ) ) : [ Formula   179 ] for  j = 1 , …  , 2  L ; j ′ = 1 , …  , 2  ( L + 1 ) ;    τ = L + 2, …  , d ; ( τ , ι ) = ( τ , 1 ) , …  , ( τ , n τ ) ;    t = 0 , … , L + 1 , τ ; ( t , i ) = ( t = 1 ) , …  , ( t , w t ) ;    α dec, j , σ dec , α ran , j ′ , j , σ ran , j ′ , α ran , ( τ , ι , 0 ) , j,  σ ran , ( τ , ι , 0 ) , φ ran , ( τ , ι , 0 ) , α del , ( τ , ι , 0) , j , σ del , ( τ , ι , 0 ) ,   φ del , ( τ , ι , 0 ) , α del , ( τ, ι , l ) , j , σ del , ( τ , ι , 1 ) , φ del , ( τ , ι , l ) ,   ηdec , ( t , i ) , η ran , j ′ , ( t , i ) , η ran , ( τ , ι , 0 ) , ( t, i ) , η del , ( τ , ι , 0 ) , ( t , i ) ,   η del , ( τ , ι , 1 ) ,( t , i ) , ψ 0 , ψ 1 ,  U  q , k L + 1 , dec * := k L , dec * + ∑ j =1 2  L  α dec , j  k L , ran , j * + { ( σ dec  ( ∑ i = 1 n L + 1 v L + 1 , i  k L , del , ( L + 1 , i , 0 ) * ) if   ρ t = 0 ( σ dec ([ k L , del , ( L + 1 , i , 1 ) * ] L + if   ρ t = 1 ∑ i = 1 n L + 1 v L + 1 , i  [ k L , del , ( L + 1 , i , 1 ) * ] L ) } + ∑ i = 1 w t η dec , ( 0 , i )  b 0 , 1 + u 0 + 1 + i * + ∑ t = 1 L + 1  ∑ i = 1 wt  η dec , ( t , i )  b t , n t + u t + i , * k L + 1 , ran , j ′ * :=∑ j = 1 2  L  α ran , j ′ , j  k L , ran , j * + { σ ran , j ′  ( ∑i = 1 n L + 1  v L + 1 , i  k L , del , ( L + 1 , i , 0 ) * ) if   ρt = 0 σ ran , j ′ ( [ k L , del , ( L + 1 , i , 1 ) * ] L + if   ρ t =1 ∑ i = 1 n L + 1  v L + 1 , i  [ k L , del , ( L + 1 , i , 1 ) * ] L) } + ∑ i = 1 w t  η ran , j ′ , ( 0 , i )  b 0 , 1 + u 0 + 1 + i * +∑ t = 1 L + 1  ∑ i = 1 w t  η ran , j ′ , ( t , i )  b t , n t + ut + i , * k L + 1 , ran , ( τ , ι , 0 ) * := ∑ j = 1 2  L  α ran , ( τ, ι )  j ,  k L , ran , j * + φ ran , ( τ , ι , 0 )  k L , ran , ( τ, ι , 0 ) * + { σ ran , ( τ , ι , 0 )  ( ∑ i = 1 n L + 1  v L + 1 , i k L , del , ( L + 1 , i , 0 ) * ) if   ρ t = 0 σ ran , ( τ , ι , 0 )( [ k L , del , ( L + 1 , i , 1 ) * ] L + if   ρ t = 1 ∑ i = 1 n L + 1 v L + 1 , i  [ k L , del , ( L + 1 , i , 1 ) * ] L ) } + ∑ i = 1 w t η del , ( τ , ι , 0 ) , ( 0 , i )  b 0 , 1 + u 0 + 1 + i * + ∑ t = 1L + 1  ∑ i = 1 w t  η del , ( τ , ι , 0 ) , ( t , i )  b t , n t + ut + i * + ∑ i = 1 w τ  η del , ( τ , ι , 0 ) , ( τ , i )  b τ , n τ +u τ + i * , k L + 1 , del , ( τ , ι , 0 ) * := ∑ j = 1 2  L  α del , (τ , ι , 0 ) , j  k L , ran , j * + φ del , ( τ , ι , 0 )  k L , ran ( τ , ι , 0 ) * + ψ 0  k L , del  ( τ , ι , 0 ) * + { σ del , ( τ , ι, 0 )  ( ∑ i = 1 n L + 1  v L + 1 , i  k L , del , ( L + 1 , i , 0) * ) if   ρ t = 0 σ del , ( τ , ι , 0 ) ( [ k L , del , ( L + 1 , i ,1 ) * ] L + if   ρ t = 1 ∑ i = 1 n L + 1  v L + 1 , i  [ k L , del ,( L + 1 , i , 1 ) * ] L ) } + ∑ i = 1 w t  η del , ( τ , ι , 0 ) , ( 0, i )  b 0 , 1 + u 0 + 1 + i * + ∑ t = 1 L + 1  ∑ i = 1 w t  η del ,( τ , ι , 0 ) , ( t , i )  b t , n t + u t + i * + ∑ i = 1 w τ  η del, ( τ , ι , 0 ) , ( τ , i )  b τ , n τ + u τ + i * , [ Formula   180] k L + 1 , del , ( τ , ι , 1 ) * := ∑ j = 1 2  L  α del , ( τ , ι , 1) , j  k L , ran , j * + ψ 1  k L , del  ( τ , ι , 1 ) * + { σ del ,( τ , ι , 1 )  ( ∑ i = 1 n L + 1  v L + 1 , i  k L , del , ( L + 1 ,i , 0 ) * ) if   ρ t = 0 σ del , ( τ , ι , 1 ) ( [ k L , del , ( L + 1, i , 1 ) * ] L + if   ρ t = 1 ∑ i = 1 n L + 1  v L + 1 , i  [ k L ,del , ( L + 1 , i , 1 ) * ] L ) } + ∑ i = 1 w t  η del , ( τ , ι , 1 ), ( 0 , i )  b 0 , 1 + u 0 + 1 + i * + ∑ t = 1 L + 1  ∑ i = 1 w t  ηdel , ( τ , ι , 1 ) , ( t , i )  b t , n t + u t + i * + ∑ i = 1 w τ η del , ( τ , ι , 1 ) , ( τ , i )  b τ , n τ + u τ + i * , sk L + 1 :=( ( ( v → 1 , ρ 1 ) , …  , ( v → L + 1 , ρ L + 1 ) ) ;   k L + 1 ,dec * , { k L + 1 , ran , j ′ * } j ′ = 1 , …  , 2  ( L + 1 ) , { kL + 1 , ran , ( τ , ι , 0 ) * , k L + 1 , del , ( τ , ι , 0 ) * ,   kL + 1 , del , ( τ , ι , 1 ) * } τ = L + 2 , …  , d ; ( τ , ι ) = ( τ ,1 ) , …  , ( τ , n τ ) ) , return   sk L + 1 .

When the lower-level decryption device 300 executes the Dec algorithmusing the delegation key sk_(L+1), the session key K is computed bycomputing Formula 170 if the inner product of (v{right arrow over ( )}₁,. . . , v{right arrow over ( )}_(L+1)) and (x{right arrow over ( )}₁, .. . , x{right arrow over ( )}_(L+1)) is 0 in (S403) of FIG. 15.

As described above, the cryptographic processing system 10 according tothe second embodiment realizes the HPE scheme for inner products thatallows decryption if the inner product of the attribute information andthe predicate information is 0 for some portions and if the innerproduct of the attribute information and the predicate information isnot 0 for the remaining portions. Therefore, it is possible to set acombination of positive and negative conditions and so on, for example.

In the above description, dimensions u_(t), w_(t), and z_(t) (t=0, . . ., d) are provided for enhanced security. Therefore, at the cost ofreduced security, dimensions u_(t), w_(t), and z_(t) (t=0, . . . , d)may be omitted by setting u_(t), w_(t), and z_(t) (t=0, . . . , d)respectively to 0.

In the above description, 1+u₀+1+w₀+z₀ is set in N₀ andn_(t)+u_(t)+w_(t)+z_(t) is set in N_(t). However, 1+u₀+1+w₀+z₀ may bereplaced with 1+1+1+1+1 so that 5 is set in N₀, andn_(t)+u_(t)+w_(t)+z_(t) may be replaced with n_(t)+n_(t)+n_(t)+1 so that3n_(t)+1 is set in N_(t).

In this case, the KeyGen algorithm shown in Formulas 168 and 169 arerewritten as shown in Formulas 181 and 182.

$\begin{matrix}{{{KeyGen}\left( {{pk},{sk},\left( {{\overset{->}{v}}_{1},\rho_{1}} \right),\ldots \mspace{14mu},\left( {{\overset{->}{v}}_{L},\rho_{L}} \right)} \right)}:=} & \left\lbrack {{Formula}\mspace{14mu} 181} \right\rbrack \\{\mspace{79mu} \left( {\left( {{\left( {v_{1,1},\ldots \mspace{14mu},v_{1},_{n_{1}}} \right) \in _{q}^{n_{1}}},{\rho_{1} \in \left\{ {0,1} \right\}}} \right),\ldots \mspace{14mu},} \right.} & \; \\{\left. \mspace{205mu} \left( {{\left( {v_{L,1},\ldots \mspace{14mu},v_{L,n_{L}}} \right) \in _{q}^{n_{L}}},{\rho_{L} \in \left\{ {0,1} \right\}}} \right) \right):} & \; \\{\; {{for}\mspace{79mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}\mspace{79mu} {{\tau = {L + 1}},\ldots \mspace{14mu},{d;{\left( {\tau,l} \right) = \left( {\tau,1} \right)}},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}}} & \; \\{\mspace{11mu} {{\psi,s_{{dec},t},{{s_{{ran},j,t}\overset{U}{}{_{q}\left( {{t = 1},\ldots \mspace{14mu},L} \right)}};}}\mspace{79mu} {\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{}_{q}},}}} & \; \\{{\overset{->}{\eta}}_{{dec},t},{\overset{->}{\eta}}_{{ran},j,t},{\overset{->}{\eta}}_{{ran},0,t},{{{\overset{->}{\eta}}_{{del},0,t}\mspace{14mu} {{\overset{->}{\eta}}_{{del},1,t}\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)};}} & \; \\{\mspace{11mu} {s_{{ran},0,t},s_{{del},0,t},{s_{{del},1,t}\overset{U}{}_{q}},\mspace{79mu} \theta_{{ran},0,t},\theta_{{del},0,t},{\theta_{{del},1,t}\overset{U}{}_{q}},}} & \; \\{{\overset{->}{\eta}}_{{ran},0,{({\tau,1})}},{\overset{->}{\eta}}_{{del},0,{({\tau,l})}},{{\overset{->}{\eta}}_{{del},1,{({\tau,l})}}\overset{U}{}_{q}^{n_{t}}},{\left( {{t = 0},\ldots \mspace{14mu},{L + 1}} \right);}} & \; \\{{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},{s_{{ran},0,0}:={\sum\limits_{t = 1}^{L}s_{{ran},0,t}}},} & \; \\{\mspace{11mu} {{s_{{del},0,0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},0,t}}},{s_{{del},1,0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},1,t}}},}} & \; \\{k_{L,{dec}}^{*}:=\left( {\left( {{- s_{{dec},0}},0,1,\eta_{{dec},0},0} \right)_{_{0}^{*}},} \right.} & \; \\{\left. {{{\begin{Bmatrix}{\left( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t,}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{dec},t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{dec},t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{dec},t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix}:t} = {1\ldots}}\mspace{14mu},L} \right),} & \; \\{k_{L,{ran},j}^{*}:=\left( {\left( {{- s_{{ran},j,0}},0,0,\eta_{{ran},j,0},0} \right)_{_{0}^{*}},} \right.} & \; \\{\begin{Bmatrix}{\left( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},j,t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{ran},j,t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},j,t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix}:} & \; \\{\left. \mspace{464mu} {{t = 1},\ldots \mspace{14mu},L} \right),} & \; \\{k_{L,{ran},{({\tau,l,0})}}^{*}:=\left( {\left( {{- s_{{ran},0,0}},0,0,\eta_{{ran},0,0},0} \right)_{_{0}^{*}},} \right.} & \left\lbrack {{Formula}\mspace{14mu} 182} \right\rbrack \\{\left\{ \begin{matrix}{\left( {{{s_{{ran},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},0,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},0,t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{ran},0,t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},0,t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{matrix} \right\} :} & \; \\{\left. \mspace{464mu} {{t = 1},\ldots \mspace{14mu},L} \right),} & \; \\{\left. \mspace{11mu} \left( {{s_{{ran},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{n_{\tau}},{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}},0} \right)_{_{\tau}^{*}} \right),} & \; \\{k_{L,{del},{({\tau,l,0})}}^{*}:=\left( {\left( {{- s_{{del},0,0}},0,0,\eta_{{del},0,0},0} \right)_{_{0}^{*}},} \right.} & \; \\{\left\{ \begin{matrix}{\left( {{{s_{{del},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},0,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{del},0,t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{del},0,t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{del},0,t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{matrix} \right\} :} & \; \\{\left. \mspace{455mu} {{t = 1},\ldots \mspace{14mu},L} \right),} & \; \\\left. \; \left( {{s_{{del},0,{L + 1}}{\overset{->}{e}}_{\tau,l}},{\psi \; {\overset{->}{e}}_{\tau,l}},0^{n_{\tau}},{\overset{->}{\eta}}_{{del},0,{({\tau,l})}},0} \right)_{_{\tau}^{*}} \right) & \; \\{k_{L,{del},{{({\tau,l,1})}:}}^{*}:=\left( {\left( {{- s_{{del},1,0}},0,0,\eta_{{del},1,0},0} \right)_{_{0}^{*}},} \right.} & \; \\{\left\{ \begin{matrix}{\left( {{{s_{{del},1,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},1,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{del},1,t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{del},1,t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{del},1,t},0} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{matrix} \right\} :} & \; \\{\left. \mspace{455mu} {{t = 1},\ldots \mspace{14mu},L} \right),} & \; \\{\left. \; \left( {{s_{{del},1,{L + 1}}{\overset{->}{e}}_{\tau,l}},0^{n_{\tau}},{\overset{->}{\eta}}_{{del},1,{({\tau,l})}},0} \right)_{_{\tau}^{*}} \right),} & \; \\{{sk}_{L}:=} & \; \\{\mspace{40mu} {\begin{pmatrix}{{\left( {\left( {{\overset{->}{v}}_{1},\rho_{1}} \right),\ldots \mspace{14mu},\left( {{\overset{->}{v}}_{L},\rho_{L}} \right)} \right);k_{L,{dec}}^{*}},\left\{ k_{L,{ran},j}^{*} \right\}_{{j = 1},\mspace{11mu} \ldots \mspace{14mu},{2L}},} \\\begin{Bmatrix}{k_{L,{ran},{({\tau,l,0})}}^{*},k_{L,{del},{({\tau,l,0})}}^{*},} \\k_{L,{del},{({\tau,l,1})}}^{*}\end{Bmatrix}_{{\tau = {L + 1}},\ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\ldots \mspace{14mu},{({\tau,n_{\tau}})}}\end{pmatrix},}} & \; \\{\; {{return}\mspace{14mu} {{sk}_{L}.}}} & \;\end{matrix}$

The Delegate_(L) algorithm shown in Formulas 179 and 180 are rewrittenas shown in Formulas 183 and 184.

$\begin{matrix}{\mspace{79mu} {{{{Delegate}_{L}\left( {{pk},{sk}_{L},{\left( {{\overset{->}{v}}_{L + 1},\rho_{L + 1}} \right):=\left( {\left( {v_{{L + 1},},\ldots \mspace{14mu},v_{{L + 1},n_{L + 1}}} \right),\rho_{L + 1}} \right)}} \right)}:\mspace{20mu} {for}}\mspace{20mu} {{j = 1}, \ldots \mspace{14mu},{{2L};}}\mspace{20mu} {{j^{\prime} = 1},\ldots \mspace{14mu},{{2\left( {L + 1} \right)};}}\mspace{20mu} {{\tau = {L + 2}},\ldots \mspace{14mu},{d;}}\mspace{20mu} {{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}\mspace{20mu} {{t = 0},\ldots \mspace{14mu},{L + 1},{\tau;}}\mspace{20mu} {{\left( {t,i} \right) = \left( {t,1} \right)},\ldots \mspace{14mu},{\left( {t,n_{t}} \right);}}\mspace{20mu} {\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l,0})},j},\sigma_{{ran},{({\tau,l,0})}},\varphi_{{ran},{({\tau,l,0})}},\mspace{20mu} {\alpha_{{del},{({\tau,l,0})},}\sigma_{{del},{({\tau,l,0})}}},\varphi_{{del},{({\tau,l,0})}},\alpha_{{del},{({\tau,l,1})},j},\sigma_{{del},{({\tau,l,1})}},\varphi_{{del},{({\tau,l,1})}},\mspace{20mu} \eta_{{dec},{({t,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l,0})},{({t,i})}},\eta_{{del},{({\tau,l,0})},{({t,i})}},\eta_{{del},{({\tau,l,1})},{({t,i})}},\mspace{20mu} \psi_{0},\psi_{1},{\overset{U}{}_{q}},}}} & \left\lbrack {{Formula}\mspace{14mu} 183} \right\rbrack \\{{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}\left( {\sigma_{dec}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} \right. & {{{if}\mspace{14mu} \rho_{t}} = 0} \\\left( {\sigma_{dec}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} \right. & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\eta_{{dec},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{i}}{\eta_{{dec},{({t,i})}}b_{t,{{2n_{t}} + i},}^{*}}}}}}{{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}{\sigma_{{ran},j^{\prime}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{{del}{({{L + 1},i,0})}}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{ran},j^{\prime}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\eta_{{ran},j^{\prime},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}}}},}} & \; \\{{k_{{L + 1},{ran},{({\tau,l,0})}}^{*}:={\sum\limits_{j = 1}^{2L}\alpha_{{ran},{{({\tau,l})}j}}}},{k_{L,{ran},j}^{*} + {\varphi_{{ran},{({\tau,l,0})}}k_{L,{ran},{({\tau,l,0})}}^{*}} + \begin{Bmatrix}{\sigma_{{ran},{({\tau,l,0})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{ran},{({\tau,l,0})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\eta_{{del},{({\tau,l,0})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}},} & \; \\{{{k_{{L + 1},{del},{({\tau,l,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l,0})},j}k_{L,{ran},j}^{*}}} + {\varphi_{{del},{({\tau,l,0})}}k_{L,{{ran}{({\tau,l,0})}}}^{*}} + {\psi_{0}k_{L,{{del}{({\tau,l,0})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,0})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,0})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L}{\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\eta_{{del},{({\tau,l,0})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}}},{k_{{L + 1},{del},{({\tau,l,1})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{{del}{({\tau,l,1})}},j}k_{L,{ran},j}^{*}}} + {\psi_{1}k_{L,{{del}{({\tau,l,1})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,1})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,1})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\eta_{{del},{({\tau,l,1})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{del},{({\tau,l,1})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{del},{({\tau,l,1})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}}},{{sk}_{L + 1}:=\left( {{\left( {\left( {{\overset{->}{v}}_{1},\rho_{1}} \right),\ldots \mspace{14mu},\left( {{\overset{->}{v}}_{L + 1},\rho_{L + 1}} \right)} \right);k_{{L + 1},{dec}}^{*}},\left\{ k_{{L + 1},{ran},j^{\prime}}^{*} \right\}_{{j^{\prime} = 1},\mspace{11mu} \ldots \mspace{14mu},{2{({L + 1})}}},\left\{ {k_{{L + 1},{ran},{({\tau,l,0})}}^{*},k_{{L + 1},{del},{({\tau,l,0})}}^{*},k_{{L + 1},{del},{({\tau,l,1})}}^{*}} \right\}_{{\tau = {L + 2}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}}} \right)},\mspace{20mu} {{return}\mspace{14mu} {{sk}_{L + 1}.}}}\mspace{214mu}} & \left\lbrack {{Formula}\mspace{14mu} 184} \right\rbrack\end{matrix}$

The Dec algorithm shown in Formula 172 remains the same.

The Setup algorithm needs to be executed once when the cryptographicprocessing system 10 is set up, and does not have to be executed eachtime a decryption key is generated. In the above description, the Setupalgorithm and the KeyGen algorithm are executed by the key generationdevice 100. However, the Setup algorithm and the KeyGen algorithm may beexecuted by different devices.

Third Embodiment

In the above embodiments, the methods for implementing the cryptographicprocesses in dual vector spaces have been described. In this embodiment,a method for implementing the cryptographic processes in dual moduleswill be described.

That is, in the above embodiments, the cryptographic processes areimplemented in cyclic groups of prime order q. However, when a ring R isexpressed using a composite number M as shown in Formula 185, thecryptographic processes described in the above embodiments can beadapted to a module having the ring R as a coefficient.

/M

  [Formula 185]

where

: integer,M: composite number.

When the HPE scheme described in the first embodiment is implemented inthe module having the R as the coefficient, the HPE scheme isrepresented as shown in Formulas 186 to 193.

$\begin{matrix}{{{{Setup}\left( {1^{\lambda},{\overset{->}{n}:=\left( {{d;n_{1}},\ldots \mspace{14mu},n_{d},u_{0}, \ldots \mspace{14mu},u_{d},w_{0},\ldots \mspace{14mu},w_{d},z_{0},\ldots \mspace{14mu},z_{d}} \right)}} \right)}:{{\left( {{param}_{\overset{->}{n}},\left\{ {_{t},_{t}^{*}} \right\}_{{t = 0},\mspace{11mu} \ldots \mspace{14mu},d}} \right)\overset{R}{}_{ob}}\left( {1^{\lambda},\overset{->}{n}} \right)}},} & \left\lbrack {{Formula}\mspace{14mu} 186} \right\rbrack \\{{{\hat{}}_{0}:=\left( {b_{0,1},b_{0,{1 + u_{0} + 1}},b_{0,{1 + u_{0} + 1 + w_{0} + 1}}, \ldots \mspace{14mu},b_{0,{1 + u_{0} + 1 + w_{0} + z_{0}}}} \right)},} & \; \\{{\hat{}}_{t}:=\left( {b_{t,1},\ldots \mspace{14mu},b_{t,n_{t}},b_{t,{n_{t} + u_{t} + w_{t} + 1}},\ldots \mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t} + z_{t}}}} \right)} & \; \\{\; {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d,\mspace{79mu} {{\hat{}}_{0}^{*}:=\left( {b_{0,1}^{*},b_{0,{1 + u_{0} + 1}}^{*}} \right)},\mspace{79mu} {{\hat{}}_{t}^{*}:={{\left( {b_{t,1}^{*},\ldots \mspace{14mu},b_{t,n_{t}}^{*}} \right)\mspace{79mu} {for}\mspace{14mu} t} = 1}},\ldots \mspace{14mu},d,}} & \; \\{{{pk}:=\left( {1^{\lambda},{param}_{\overset{->}{n}},\left\{ {\hat{}}_{t} \right\}_{{t = 0},\mspace{11mu} \ldots \mspace{14mu},d},b_{0,{1 + u_{0} + 1 + 1}}^{*},\ldots \mspace{14mu},b_{0,{1 + u_{0} + 1 + w_{0}}}^{*},\left\{ {b_{t,{n_{t} + u_{t} + 1}}^{*},\ldots \mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t}}}^{*}} \right\}_{{t = 1},\mspace{11mu} \ldots \mspace{14mu},d}} \right)},} & \; \\{\; {{{sk}:=\left\{ {\hat{}}_{t}^{*} \right\}_{{t = 0},\mspace{11mu} \ldots \mspace{14mu},d}},\mspace{79mu} {{return}\mspace{14mu} {pk}},{{sk}.}}} & \; \\{_{ob}\left( {1^{\lambda},{\overset{->}{n}:=\left( {d;{\overset{->}{n}:=\left( {{d;n_{1}},\ldots \mspace{14mu},n_{d},u_{0},\ldots \mspace{14mu},u_{d},w_{0},\ldots \mspace{14mu},w_{d},z_{0},\ldots \mspace{14mu},z_{d}} \right)}} \right.}} \right.} & \left\lbrack {{Formula}\mspace{14mu} 187} \right\rbrack \\{{N_{0}:={1 + u_{0} + 1 + w_{0} + z_{0}}},{N_{t}:={n_{t} + u_{t} + w_{t} + z_{t}}}} & \; \\{{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d,\mspace{79mu} {{param}_{}:={{\left( {q,,_{T},g,e} \right)\overset{R}{}_{bpg}}\left( 1^{\lambda} \right)}},} & \; \\{\; {{\psi \overset{U}{}{\mathbb{R}}^{x}},\mspace{79mu} {{{For}\mspace{14mu} t} = 0},\ldots \mspace{14mu},d,}} & \; \\{{{param}_{_{t}}:={\left( {q,_{t},_{T},_{t},e} \right):={_{dpvs}\left( {1^{\lambda},N_{t},{param}_{}} \right)}}},} & \; \\{{X_{t}:={\left( \chi_{i,i,j} \right)_{i,j}\overset{U}{}{{GL}\left( {N_{t},{\mathbb{R}}} \right)}}},{\left( v_{t,i,j} \right)_{i,j}:={\phi \cdot \left( X_{t}^{T} \right)^{- 1}}},} & \; \\{{b_{t,i}:={\left( {\chi_{t,i,1},\ldots \mspace{14mu},\chi_{t,i,N_{t}}} \right)_{_{t}} = {\sum\limits_{j = 1}^{N_{t}}{\chi_{t,i,j}a_{t,j}}}}},} & \; \\{{_{t}:=\left( {b_{t,1},\ldots \mspace{14mu},b_{t,N_{t}}} \right)},} & \; \\{{b_{t,i}^{*}:={\left( {v_{t,i,1},\ldots \mspace{14mu},v_{t,i,N_{t}}} \right)_{_{t}} = {\sum\limits_{j = 1}^{N_{t}}{v_{t,i,j}a_{t,j}}}}},} & \; \\{{_{t}^{*}:=\left( {b_{t,1}^{*},\ldots \mspace{14mu},b_{t,N_{t}}^{*}} \right)},{g_{T}:={e\left( {g,g} \right)}^{\psi}},} & \; \\{{param}_{\overset{->}{n}}:=\left( {\left\{ {param}_{_{t}} \right\}_{{t = 0},\mspace{11mu} \ldots \mspace{14mu},d,}g_{T}} \right)} & \; \\{\; {{return}\mspace{14mu} {\left( {{param}_{\overset{->}{n}},\left\{ {_{t},_{t}^{*}} \right\}_{{t = 0},\mspace{11mu} \ldots \mspace{14mu},d}} \right).}}} & \; \\{{{KeyGen}\left( {{pk},{sk},{\left( {{\overset{->}{v}}_{1},\ldots \mspace{14mu},{\overset{->}{v}}_{L}} \right):=\left( {v_{1,1},\ldots \mspace{14mu},v_{1,n_{1}}} \right)}, \ldots \mspace{14mu},\left( {v_{L,1},\ldots \mspace{14mu},v_{L,n_{L}}} \right)} \right)}:} & \left\lbrack {{Formula}\mspace{14mu} 188} \right\rbrack \\{{{{{for}\mspace{14mu} j} = 1}, \ldots \mspace{14mu},{{2L};}}\mspace{79mu} {{\tau = {L + 1}},\ldots \mspace{14mu},{d;}}\mspace{79mu} {{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}} & \; \\{\mspace{11mu} {\psi,s_{{dec},t},{{{s_{{ran},j,t}\overset{U}{}{\mathbb{R}}}\left( {{t = 1},\ldots \mspace{14mu},L} \right)};}}} & \; \\{\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{}{\mathbb{R}}},{\overset{->}{\eta}}_{{dec},t},{{{\overset{->}{\eta}}_{{ran},j,t}\overset{U}{}{{\mathbb{R}}^{w_{t}}\left( {{t = 0},\ldots \mspace{14mu},L} \right)}};}} & \; \\{\; {s_{{ran},{({\tau,l})},t},{{{s_{{del},{({\tau,l})},t}\overset{U}{}{\mathbb{R}}}\left( {{t = 1},\ldots \mspace{14mu},{L + 1}} \right)};}}} & \; \\{\theta_{{ran},{({\tau,l})},t},{\theta_{{del},{({\tau,l})},t}\overset{U}{}{\mathbb{R}}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},} & \; \\{{{\overset{->}{\eta}}_{{del},{({\tau,l})},t}\overset{U}{}{\mathbb{R}}^{w_{t}}},{\left( {{t = 0},\ldots \mspace{14mu},{L + 1}} \right);}} & \; \\{{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},} & \; \\{{s_{{ran},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{ran},{({\tau,l})},t}}},{s_{{del},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},{({\tau,l})},t}}},} & \; \\{k_{L,{dec}}^{*}:=\left( {\left( {{- s_{{dec},0}},0^{u_{0}},1,{\overset{->}{\eta}}_{{dec},0},0^{z_{0}}} \right)_{_{0}^{*}},} \right.} & \left\lbrack {{Formula}\mspace{14mu} 189} \right\rbrack \\{\left. {{{\left( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} \right)_{_{t}^{*}}:t} = 1},\ldots \mspace{14mu},L} \right),} & \; \\{k_{L,{ran},j}^{*}:=\left( {\left( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} \right)_{_{0}^{*}},} \right.} & \; \\{\left. {{\left( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} \right)_{_{t}^{*}}:{t - 1}}, \ldots \mspace{14mu},L} \right),} & \; \\{k_{L,{ran},{({\tau,l})}}^{*}:=\left( {\left( {{- s_{{ran},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},{({\tau,l})},0},0^{z_{0}}} \right)_{_{0}^{*}},{{\left( {{{s_{{ran},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},0^{z_{t}}} \right)_{_{t}^{*}}:t} =}} \right.} & \; \\{\left. {1, \ldots \mspace{14mu},{L\left( {{s_{{ran},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},{L + 1}},0^{z_{\tau}}} \right)}_{_{\tau}^{*}}} \right),} & \; \\{k_{L,{del},{({\tau,l})}}^{*}:=\left( {\left( {{- s_{{del},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},{({\tau,l})},0},0^{z_{0}}} \right)_{_{0}^{*}},} \right.} & \; \\{{{\left( {{{s_{{del},{({\tau,t})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},{({\tau,l})},t},0^{z_{t}}} \right)_{_{t}^{*}}:t} = 1}, \ldots \mspace{14mu},} & \; \\{\left. {L\left( {{{s_{{del},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}} + {\psi \; {\overset{->}{e}}_{\tau,l}}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},{({\tau,l})},{L + 1}},0^{z_{\tau}}} \right)_{_{\tau}^{*}}} \right),} & \; \\{{{sk}_{L}:=\left( {k_{L,{dec}}^{*},\left\{ k_{L,{ran},j}^{*} \right\}_{{j = 1},\mspace{11mu} \ldots \mspace{14mu},{2L}},\left\{ k_{L,{ran},{({\tau,l})}}^{*} \right\}_{{\tau = {L + 1}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}},\left\{ k_{L,{del},{({\tau,l})}}^{*} \right\}_{{\tau = {L + 1}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,1})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}}} \right)},} & \; \\{{{return}\mspace{14mu} {{sk}_{L}.}}\mspace{11mu}} & \; \\{{Enc}\left( {{pk},{m \in _{T}},{{\left( {{\overset{->}{x}}_{1},\ldots \mspace{14mu},{\overset{->}{x}}_{L}} \right):={\left( {\left( {x_{1,1},\ldots \mspace{14mu},x_{1,n_{1}}} \right),\ldots \mspace{14mu},\left( {x_{L,1},\ldots \mspace{14mu},x_{L,n_{L}}} \right)} \right):{{\left( {{\overset{->}{x}}_{L + 1},\ldots \mspace{14mu},{\overset{->}{x}}_{d}} \right)\overset{U}{}{\mathbb{R}}^{n_{L + 1}}} \times \ldots \times {\mathbb{R}}^{n_{d}}}}};}} \right.} & \left\lbrack {{Formula}\mspace{14mu} 190} \right\rbrack \\{\; {\omega,{\zeta \overset{U}{}{\mathbb{R}}},{{{\overset{->}{\phi}}_{t}\overset{U}{}{\mathbb{R}}^{z_{t}}}\left( {{t = 0},\ldots \mspace{14mu},d} \right)},}} & \; \\{{c_{1}:=\left( {\left( {\omega,0^{u_{0}},\zeta,0^{w_{0}},{\overset{->}{\phi}}_{0}} \right)_{_{0}},{{\left( {{\omega \; {\overset{->}{x}}_{t}},0^{u_{t}},0^{w_{t}},{\overset{->}{\phi}}_{t}} \right)_{\; t}:t} = 1},\ldots \mspace{14mu},d} \right)},} & \; \\{{c_{2}:={g_{T}^{\zeta}m}},\mspace{59mu} \mspace{79mu} {{ct}:=\left( {c_{1},c_{2}} \right)},\mspace{79mu} {{return}\mspace{14mu} {{ct}.}}} & \; \\{\; {{{{{Dec}\left( {{pk},k_{L,{dec}}^{*},{ct}} \right)}:m^{\prime}}:={c_{2}/{e\left( {c_{1},k_{L,{dec}}^{*}} \right)}}}\mspace{79mu} {{return}\mspace{14mu} {m^{\prime}.}}}} & \left\lbrack {{Formula}\mspace{14mu} 191} \right\rbrack \\{{{Delegate}_{L}\left( {{pk},{sk}_{L},{{\overset{->}{v}}_{L + 1}:=\left( {v_{{L + 1},1},\ldots \mspace{14mu},v_{{L + 1},n_{L + 1}}} \right)}} \right)};} & \left\lbrack {{Formula}\mspace{14mu} 192} \right\rbrack \\{{for}\mspace{79mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}\mspace{79mu} {{j^{\prime} = 1},\ldots \mspace{14mu},{{2\left( {L + 1} \right)};}}\mspace{79mu} {{\tau = {L + 2}}, \ldots \mspace{14mu},{d;}}} & \; \\{\mspace{11mu} {{{\left( {\tau,l} \right) = \left( {\tau,l} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}\mspace{79mu} {{t = 0},\ldots \mspace{14mu},{L + 1},{\tau;}}\mspace{79mu} {{\left( {t,i} \right) = \left( {t,1} \right)},\ldots \mspace{14mu},{\left( {t,w_{t}} \right);}}\mspace{79mu} {\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l})},j},\sigma_{{ran},{({\tau,l})}},}}} & \; \\{\mspace{11mu} {\varphi_{{ran},{({\tau,l})}},\alpha_{{del},{({\tau,l})},j},\sigma_{{del},{({\tau,l})}},\varphi_{{del},{({\tau,l})}},\psi^{\prime},\mspace{79mu} \eta_{{dec},{({t,i})}},\eta_{{ran},{({t,i})}},\eta_{{ran},{({\tau,l})},{({t,i})}},{\eta_{{del},{({\tau,l})},{({t,i})}}\overset{U}{}{\mathbb{R}}},}} & \; \\{{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}},} & \left\lbrack {{Formula}\mspace{14mu} 193} \right\rbrack \\{{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}},} & \; \\{{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\varphi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{k_{{L + 1},{del},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,i})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\psi^{\prime}k_{L,{del},{({\tau,l})}}^{*}} + {\varphi_{{del},{({\tau,l})}}k_{L,{{ran}{({\tau,l})}}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{{sk}_{L + 1}:=\left( {k_{{L + 1},{dec}}^{*},\left\{ k_{{L + 1},{ran},j^{\prime}}^{*} \right\}_{{j^{\prime} = 1},\mspace{11mu} \ldots \mspace{14mu},{2{({L + 1})}}},\left\{ {k_{{L + 1},{ran},{({\tau,l})}}^{*},k_{{L + 1},{del},{({\tau,l})}}^{*}} \right\}_{{\tau = {L + 2}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}}} \right)},\mspace{79mu} {{return}\mspace{14mu} {sk}_{L + 1}}} & \;\end{matrix}$

When the HPE scheme described in the second embodiment is implemented inthe module having the ring R as the coefficient, the HPE scheme isexpressed as shown in Formulas 194 to 199. The Setup algorithm and theG_(ob) algorithm are as shown in Formulas 186 and 187 respectively.

$\begin{matrix}{{{{KeyGen}\left( {{pk},{sk},\left( {{\overset{->}{v}}_{1},\rho_{1}} \right),\ldots \mspace{14mu},\left( {{\overset{->}{v}}_{L},\rho_{L}} \right)} \right)}:={\left( {\left( {{\left( {v_{1,1},\ldots \mspace{14mu},v_{1,n_{1}}} \right) \in {\mathbb{R}}^{n_{1}}},{\rho_{1} \in \left\{ {0,1} \right\}}} \right),\ldots \mspace{14mu},\left( {{\left( {v_{L,1},\ldots \mspace{14mu},v_{L,n_{L}}} \right) \in {\mathbb{R}}^{n_{L}}},{\rho_{L} \in \left\{ {0,1} \right\}}} \right)} \right):\mspace{20mu} {for}}}\mspace{20mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}\mspace{20mu} {{\tau = {L + 1}},\ldots \mspace{14mu},{d;}}\mspace{20mu} {{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}\mspace{20mu} {\psi,s_{{dec},t},{{s_{{ran},j,t}\overset{U}{}{{\mathbb{R}}\left( {{t = 1},\ldots \mspace{14mu},L} \right)}};}}\mspace{20mu} {\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{}{\mathbb{R}}},\mspace{20mu} {\overset{->}{\eta}}_{{dec},t},{\overset{->}{\eta}}_{{ran},j,t},{\overset{->}{\eta}}_{{ran},0,t},{{{\overset{->}{\eta}}_{{del},0,t}{{\overset{->}{\eta}}_{{del},1,t}\overset{U}{}{\mathbb{R}}^{w_{t}}}\mspace{14mu} \left( {{t = 0},\ldots \mspace{14mu},L} \right)};}}\mspace{20mu} {s_{{ran},0,t},s_{{del},0,t},{s_{{del},1,t}\overset{U}{}{\mathbb{R}}},\mspace{20mu} \theta_{{ran},0,t},\theta_{{del},0,t},{\theta_{{del},1,t}\overset{U}{}{\mathbb{R}}},}} & \left\lbrack {{Formula}\mspace{14mu} 194} \right\rbrack \\{\mspace{79mu} {{{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}},{\overset{–}{\eta}}_{{del},0,{({\tau,l})}},{{\overset{->}{\eta}}_{{del},1,{({\tau,l})}}\overset{U}{}{\mathbb{R}}^{w_{t}}},{\left( {{t = 0},\ldots \mspace{14mu},{L + 1}} \right);}}\mspace{20mu} {{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},{s_{{ran},0,0}:={\sum\limits_{t = 1}^{L}s_{{ran},0,t}}},\mspace{20mu} {s_{{del},0,0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},0,t}}},{s_{{del},1,0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},1,t}}},\mspace{20mu} {k_{L,{dec}}^{*}:=\left( {\left( {{- s_{{dec},0}},0^{u_{0}},1,{\overset{->}{\eta}}_{{dec},0},0^{z_{0}}} \right)_{_{0}^{*}},{{\begin{Bmatrix}{\left( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t,}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{dec},t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix}:t} = 1},\ldots \mspace{14mu},L} \right)},\mspace{20mu} {k_{L,{ran},j}^{*}:=\left( {\left( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} \right)_{_{0}^{*}},{{\left\{ \begin{matrix}{\left( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} \right)_{^{*t}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{ran},j,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{matrix} \right\} :t} = 1},\ldots \mspace{14mu},L} \right)},}}} & \; \\{\left. {\left. \mspace{79mu} {{k_{L,{ran},{({\tau,l,0})}}^{*}:=\left( {\left( {{- s_{{ran},0,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},0,0},0^{z_{0}}} \right)_{_{0}^{*}},{{\left\{ \begin{matrix}{\left( {{{s_{{ran},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},0,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},0,t},0^{z_{t}}} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{ran},0,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},0,t},0^{z_{t}}} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{matrix} \right\} :t} = 1},\ldots \mspace{14mu},L} \right)},\mspace{20mu} \left( {{s_{{ran},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}},0^{z_{\tau}}} \right)_{_{\tau}^{*}}} \right),\mspace{20mu} {k_{L,{del},{({\tau,l,0})}}^{*}:=\left( {\left( {{- s_{{del},0,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},0,0},0^{z_{0}}} \right)_{_{0}^{*}},{{\left\{ \begin{matrix}{\left( {{{s_{{del},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},0,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},0,t},0^{z_{t}}} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{del},0,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{del},0,t},0^{z_{t}}} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{matrix} \right\} :t} = 1},\ldots \mspace{14mu},L} \right)},\mspace{20mu} \left( {{s_{{del},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},{{+ \psi}{\overset{->}{e}}_{\tau,l}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},0,{({\tau,l})}},0^{z_{\tau}}} \right)_{_{\tau}^{*}}} \right),} & \left\lbrack {{Formula}\mspace{14mu} 195} \right\rbrack \\{\left. \mspace{79mu} {{k_{L,{del},{({\tau,t,1})}}^{*}:=\left( {\left( {{{- s_{{del},1,0}}0^{u_{0}}},0,{\overset{->}{\eta}}_{{del},1,0},0^{z_{0}}} \right)_{_{0}^{*}},{{\left\{ \begin{matrix}\left( {{{s_{{del},1,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},1,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},1,t},0^{z_{t}}} \right)_{_{t}^{*}} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{del},1,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{del},1,t},0^{z_{t}}} \right)_{_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{matrix} \right\} :t} = 1},\ldots \mspace{14mu},L} \right)},\mspace{20mu} \left( {{s_{{del},1,{L + 1}}{\overset{->}{e}}_{\tau,l}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},1,{({\tau,l})}},0^{z_{t}}} \right)_{_{\tau}^{*}}} \right),\mspace{20mu} {{sk}_{L}:=\begin{pmatrix}{{\left( {\left( {{\overset{->}{v}}_{1},\rho_{1}} \right),\ldots \mspace{14mu},\left( {{\overset{->}{v}}_{L},\rho_{L}} \right)} \right);k_{L,{dec}}^{*}},\left\{ k_{L,{ran},j}^{*} \right\}_{{j = 1},\mspace{11mu} \ldots \mspace{14mu},{2L}},} \\\begin{Bmatrix}{k_{L,{ran},{({\tau,l,0})}}^{*},k_{L,{del},{({\tau,l,0})}}^{*},} \\k_{L,{del},{({\tau,l,1})}}^{*}\end{Bmatrix}_{{\tau = {L + 1}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}}\end{pmatrix}},\mspace{20mu} {{return}\mspace{14mu} {{sk}_{L}.}}} & \; \\{\mspace{79mu} {{Enc}\left( {{pk},{m \in _{T}},{{\left( {{\overset{->}{x}}_{1},\ldots \mspace{14mu},{\overset{->}{x}}_{L}} \right):={\left( {\left( {x_{1,1},\ldots \mspace{14mu},x_{1,n_{1}}} \right),\ldots \mspace{14mu},\left( {x_{L,1},\ldots \mspace{14mu},x_{L,n_{L}}} \right)} \right):\mspace{20mu} {{\left( {{\overset{->}{x}}_{L + 1},\ldots \mspace{14mu},{\overset{->}{x}}_{d}} \right)\overset{U}{}{\mathbb{R}}^{n_{L + 1}}} \times \ldots \times {\mathbb{R}}^{n_{d}}}}};\mspace{20mu} \omega},{\zeta \overset{U}{}{\mathbb{R}}},{{\overset{->}{\phi}}_{t}\overset{U}{}{{\mathbb{R}}^{z_{t}}\left( {{t = 0},\ldots \mspace{14mu},d} \right)}},\mspace{20mu} {c_{1}:=\left( {\left( {\omega,0^{u_{0}},\zeta,0^{w_{0}},{\overset{->}{\phi}}_{0}} \right)_{_{0}},{{\left( {{\omega \; {\overset{->}{x}}_{t}},0^{u_{t}},0^{w_{t}},{\overset{->}{\phi}}_{t}} \right)_{\; t}:t} = 1},\ldots \mspace{14mu},d} \right)},\mspace{20mu} {c_{2}:={g_{T}^{\zeta}m}},\mspace{20mu} {{ct}:=\left( {{\left( {{\overset{->}{x}}_{1},\ldots \mspace{14mu},{\overset{->}{x}}_{L}} \right);c_{1}},c_{2}} \right)},\mspace{20mu} {{return}\mspace{14mu} {{ct}.}}} \right.}} & \left\lbrack {{Formula}\mspace{14mu} 196} \right\rbrack \\{\mspace{79mu} {{{{{Dec}\left( {{pk},{sk}_{L},{ct}} \right)}:K}:={{e\left( {c_{1,0},k_{L,{dec},0}^{*}} \right)} \cdot {\prod\limits_{{1 \leq t \leq {d\bigwedge\rho_{t}}} = 0}{{e\left( {c_{1,t},k_{L,{dec},t}^{*}} \right)} \cdot {\prod\limits_{{1 \leq t \leq {d\bigwedge\rho_{t}}} = 1}{e\left( {c_{1,t},k_{L,{dec},t}^{*}} \right)}^{1/{({{\overset{->}{v}}_{t} \cdot {\overset{->}{x}}_{t}})}}}}}}},\mspace{20mu} {{{where}\mspace{20mu}\left( {{k_{L,{dec},0}^{*} \in {\langle _{0}^{*}\rangle}},\ldots \mspace{14mu},{k_{L,{dec},d}^{*} \in {\langle _{d}^{*}\rangle}}} \right)}:=k_{L,{dec}}^{*}},\mspace{20mu} \left( {{c_{1,0} \in {\langle _{0}^{*}\rangle}},\ldots \mspace{14mu},{{c_{1,d} \in {\langle _{d}^{*}\rangle}}:=c_{1}},\mspace{20mu} {m^{\prime}:={c_{2}/K}},\mspace{20mu} {{return}\mspace{14mu} {m^{\prime}.}}} \right.}} & \left\lbrack {{Formula}\mspace{14mu} 197} \right\rbrack \\{\mspace{79mu} {{{{Delegate}_{L}\left( {{pk},{sk}_{L},{\left( {\overset{->}{v}}_{{L + 1},\rho_{L + 1}} \right):=\left( {\left( v_{{L + 1},1,\mspace{11mu} \ldots \mspace{14mu},v_{{L + 1},n_{L + 1}}} \right),\rho_{L + 1}} \right)}} \right)}:\mspace{20mu} {for}}\mspace{20mu} {{j = 1},\ldots \mspace{14mu},{{2L};}}\mspace{20mu} {{j^{\prime} = 1},\ldots \mspace{14mu},{{2\left( {L + 1} \right)};}}\mspace{20mu} {{\tau = {L + 2}},\ldots \mspace{14mu},{d;}}\mspace{20mu} {{\left( {\tau,l} \right) = \left( {\tau,1} \right)},\ldots \mspace{14mu},{\left( {\tau,n_{\tau}} \right);}}\mspace{20mu} {{t = 0},\ldots \mspace{14mu},{L + 1},{\tau;}}\mspace{20mu} {{\left( {t,i} \right) = \left( {t,1} \right)},\ldots \mspace{14mu},{\left( {t,w_{t}} \right);}}\mspace{20mu} {\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l,0})},j},\sigma_{{ran},{({\tau,l,0})}},\varphi_{{ran},{({\tau,l,0})}},\mspace{20mu} \alpha_{{del},{({\tau,l,0})},j},\sigma_{{del},{({\tau,l,0})}},\varphi_{{del},{({\tau,l,0})}},\alpha_{{del},{({\tau,l,1})},j},\sigma_{{del},{({\tau,l,1})}},\varphi_{{del},{({\tau,l,1})}},\mspace{20mu} \eta_{{dec},{({t,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l,0})},{({t,i})}},\eta_{{del},{({\tau,l,0})},{({t,i})}},\eta_{{del},{({\tau,t,1})},{({t,i})}},\mspace{20mu} \psi_{0},\psi_{1},{\overset{U}{}{\mathbb{R}}},{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}\left( {\sigma_{dec}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} \right. & {{{if}\mspace{14mu} \rho_{t}} = 0} \\\left( {\sigma_{dec}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} \right. & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i},}^{*}}}}}}}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}{\sigma_{{ran},j^{\prime}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{ran},j^{\prime}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i},}^{*}}}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 198} \right\rbrack \\{{k_{{L + 1},{ran},{({\tau,l,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{{({\tau,l})}j},}k_{L,{ran},j}^{*}}} + {\varphi_{{ran},{({\tau,l,0})}}k_{L,{ran},{({\tau,l,0})}}^{*}} + \begin{Bmatrix}{\sigma_{{ran},{({\tau,l,0})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{ran},{({\tau,l,0})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{{{k_{{L + 1},{del},{({\tau,l,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l,0})},j}k_{L,{ran},j}^{*}}} + {\varphi_{{del},{({\tau,l,0})}}k_{L,{{ran}{({\tau,l,0})}}}^{*}} + {\psi_{0}k_{L,{{del}{({\tau,l,0})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,0})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,0})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i},}^{*}}}}}{k_{{L + 1},{del},{({\tau,l,1})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l,1})},j}k_{L,{ran},j}^{*}}} + {\psi_{1}k_{L,{{del}{({\tau,l,1})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,1})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,1})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,1})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{del},{({\tau,l,1})},i}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,1})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i},}^{*}}}}}}{{{sk}_{L + 1}:=\left( {{\left( {\left( {{\overset{->}{v}}_{1},\rho_{1}} \right),\ldots \mspace{14mu},\left( {{\overset{->}{v}}_{L + 1},\rho_{L + 1}} \right)} \right);k_{{L + 1},{dec}}^{*}},\left\{ k_{{L + 1},{ran},j^{\prime}}^{*} \right\}_{{j^{\prime} = 1},\mspace{11mu} \ldots \mspace{14mu},{2{({L + 1})}}},\left\{ {k_{{L + 1},{ran},{({\tau,l,0})}}^{*},k_{{L + 1},{del},{({\tau,l,0})}}^{*},k_{{L + 1},{del},{({\tau,l,1})}}^{*}} \right\}_{{\tau = {L + 2}},\mspace{11mu} \ldots \mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu} \ldots \mspace{14mu},{({\tau,n_{\tau}})}}} \right)},\mspace{20mu} {{return}\mspace{14mu} {{sk}_{L + 1}.}}}}\mspace{65mu}} & \left\lbrack {{Formula}\mspace{14mu} 199} \right\rbrack\end{matrix}$

A hardware configuration of the cryptographic processing system 10 (thekey generation device 100, the encryption device 200, the decryptiondevice 300, the key delegation device 400) in the embodiments will nowbe described.

FIG. 20 is a diagram showing an example of a hardware configuration ofthe key generation device 100, the encryption device 200, the decryptiondevice 300, and the key delegation device 400.

As shown in FIG. 20, the key generation device 100, the encryptiondevice 200, the decryption device 300, and the key delegation device 400each include the CPU 911 (central processing unit, also called aprocessing unit, an arithmetic unit, a microprocessor, a microcomputer,or a processor). The CPU 911 is connected through a bus 912 with the ROM913, the RAM 914, the LCD 901 (liquid crystal display), the keyboard 902(K,bB), the communication board 915, and the magnetic disk device 920,and controls these hardware devices. The magnetic disk device 920 (fixeddisk device) may be replaced with a storage device such as an opticaldisk device or a memory card read,bwrite device. The magnetic diskdevice 920 is connected through a predetermined fixed disk interface.

The ROM 913 and the magnetic disk device 920 are examples of anonvolatile memory. The RAM 914 is an example of a volatile memory. TheROM 913, the RAM 914, and the magnetic disk device 920 are examples of astorage device (memory). The keyboard 902 and the communication board915 are examples of an input device. The communication board 915 is anexample of a communication device. The LCD 901 is an example of adisplay device.

The magnetic disk device 920, the ROM 913, or the like stores anoperating system 921 (OS), a window system 922, programs 923, and files924. The programs 923 are executed by the CPU 911, the operating system921, and the window system 922.

The programs 923 store software or programs for executing the functionsdescribed hereinabove as “the master key generation unit 110”, “themaster key storage unit 120”, “the information input unit 130”, “thedecryption key generation unit 140”, “the key distribution unit 150”,“the master public key acquisition unit 210”, “the information inputunit 220”, “the ciphertext generation unit 230”, “the data transmissionunit 240”, “the decryption key acquisition unit 310”, “the datareceiving unit 320”, “the pairing operation unit 330”, “the messagecomputation unit 340”, “the decryption key acquisition unit 410”, “theinformation input unit 420”, “the delegation key generation unit 430”,“the key distribution unit 440” and so on, as well as other programs.The programs are read and executed by the CPU 911. The files 924 storeinformation, data, signal values, variable values, and parameters, suchas “the master public key pk”, “the master secret key sk”, “thedecryption key sk_(L)”, “the delegation key sk_(L+1)”, “the ciphertextct”, “the attribute information”, “the predicate information”, and “themessage m” described hereinabove, each of which is stored as an item ofa “file” or a “database”. The “file” or “database” is stored in astorage device such as a disk or memory. The information, data, signalvalues, variable values, and parameters stored in the storage devicesuch as the disk or memory are read by the CPU 911 through a read,bwritecircuit to a main memory or a cache memory, and are used for operationsof the CPU 911 such as extraction, search, reference, comparison,calculation, computation, processing, output, printing, and display. Theinformation, data, signal values, variable values, and parameters aretemporarily stored in the main memory, the cache memory, or a buffermemory during the operations of the CPU 911 such as extraction, search,reference, comparison, calculation, computation, processing, output,printing, and display.

In the flowcharts described hereinabove, an arrow mainly represents aninput,boutput of data or a signal, and each data or signal value isstored in the RAM 914, or other types of storage medium such as anoptical disk, or an IC chip. The data or signal is transferred onlinethrough the bus 912, a signal line, a cable, other types of transfermedium, or a radio wave.

What is described hereinabove as “ . . . unit” may be “ . . . circuit”,“ . . . device”, “ . . . equipment”, “ . . . means”, or “ . . .function”, and may also be “ . . . step”, “ . . . procedure”, or “ . . .process”. What is described as “ . . . device” may be “ . . . circuit”,“ . . . equipment”, “ . . . means”, or “ . . . function”, and may alsobe “ . . . step”, “ . . . procedure”, or “ . . . process”. What isdescribed as “ . . . process” may be “ . . . step”. That is, what isdescribed as “ . . . unit” may be implemented by firmware stored in theROM 913. Alternatively, “ . . . unit” may be implemented solely bysoftware, or solely by hardware such as elements, devices, boards, andwiring, or by a combination of software and hardware, or by acombination including firmware. Firmware or software is stored as aprogram in a storage medium such as the ROM 913. The programs are readby the CPU 911 and executed by the CPU 911. That is, each program causesa computer or the like to function as “ . . . unit” described above.Alternatively, each program causes the computer or the like to execute aprocedure or a method of “ . . . unit” described above.

LIST OF REFERENCE SIGNS

-   10: cryptographic processing system, 100: key generation device,    110: master key generation unit, 120: master key storage unit, 130:    information input unit, 140: decryption key generation unit, 141:    random number generation unit, 142: decryption element generation    unit, 143: randomizing element generation unit, 144: delegation    element generation unit, 150: key distribution unit, 200: encryption    device, 210: master public key acquisition unit, 220: information    input unit, 221: attribute information input unit, 222: message    input unit, 230: ciphertext generation unit, 231: random number    generation unit, 232: ciphertext c1 generation unit, 233: ciphertext    c2 generation unit, 240: data transmission unit, 300: decryption    device, 310: decryption key acquisition unit, 320: data receiving    unit, 330: pairing operation unit, 340: message computation unit,    400: key delegation device, 410: decryption key acquisition unit,    420: information input unit, 430: delegation key generation unit,    431: random number generation unit, 432: lower-level decryption    element generation unit, 433: lower-level randomizing element    generation unit, 434: lower-level delegation element generation    unit, 440: key distribution unit

1. A cryptographic processing system that performs a cryptographicprocess using a basis B_(t) and a basis B*_(t) for each integer t oft=1, . . . , L+1 (L being an integer of 1 or more), the cryptographicprocessing system comprising: an encryption device that generates, as aciphertext ct, a vector in which attribute information x{right arrowover ( )}_(t) is embedded in a basis vector of the basis B_(t) for atleast some integer t of t=1, . . . , L; a decryption device that uses,as a decryption key sk_(L), a vector in which predicate informationv{right arrow over ( )}_(t) is embedded in a basis vector of the basisB*_(t) for each integer t of t=1, . . . , L, performs a pairingoperation on the ciphertext ct generated by the encryption device andthe decryption key sk_(L), and decrypts the ciphertext ct; and a keydelegation device that generates a lower-level decryption key sk_(L+1)of the decryption key sk_(L), based on a vector in which predicateinformation v{right arrow over ( )}_(L+1) is embedded in a basis vectorof a basis B*_(L+1) and the decryption key sk_(L) used by the decryptiondevice.
 2. The cryptographic processing system of claim 1, furthercomprising: a key generation device that generates the decryption keysk_(L), wherein the key generation device includes a first informationinput unit that inputs predicate information v{right arrow over ()}_(t): (v_(t,i)) (i=1, . . . , n_(t)) for each integer t of t=1, . . ., L; a decryption element generation unit that, using the predicateinformation v{right arrow over ( )}_(t) input by the first informationinput unit, a predetermined value Δ, a predetermined value θ_(dec,t) foreach integer t of t=1, . . . , L, and a predetermined value s_(dec,t)for each integer t of t=0, . . . , L such that s_(dec,0)=τ_(t=1)^(L)s_(dec,t), generates a decryption element k*_(L,dec) in which−s_(dec,0) is set as a coefficient of a basis vector b*_(0,p) (p being apredetermined value) of a basis B*₀, the Δ is set as a coefficient of abasis vector b*_(0,q) (q being a predetermined value) of the basis B*₀,and s_(dec,t)e{right arrow over ( )}_(t,1)+θ_(dec,t)v_(t,i) (i=1, . . ., n_(t)) is set as a coefficient of a basis vector b*_(t,i) (i=1, . . ., n_(t)) of the basis B*_(t) for each integer t of t=1, . . . , L; and adecryption key transmission unit that transmits to the decryption devicethe decryption key sk_(L) including the decryption element k*_(L,dec)generated by the decryption element generation unit, wherein theencryption device includes a second information input unit that inputsattribute information x{right arrow over ( )}_(t):=(x_(t,i)) (i=1, . . ., n_(t)) for at least some integer t of t=1, . . . , L; a ciphertext c1generation unit that, using the attribute information x{right arrow over( )}_(t) input by the second information input unit and predeterminedvalues ω and ζ, generates a ciphertext c₁ in which the ω is set as acoefficient of a basis vector b_(0,p) of a basis B₀, the ζ is set as acoefficient of a basis vector b_(0,q) of the basis B₀, and ωx_(t,i)(i=1, . . . , n_(t)) is set as a coefficient of a basis vector b_(t,i)(i=1, . . . , n_(t)) of the basis B_(t) for the at least some integer t;and a data transmission unit that transmits to the decryption device theciphertext ct including the ciphertext c₁ generated by the ciphertext c1generation unit, and wherein the decryption device includes a pairingoperation unit that performs a pairing operation e (c₁, k*_(L,dec)) onthe ciphertext c₁ included in the ciphertext ct transmitted by the datatransmission unit and the decryption element k*_(L,dec) included in thedecryption key sk_(L) transmitted by the decryption key transmissionunit.
 3. The cryptographic processing system of claim 2, wherein theencryption device further includes a ciphertext c2 generation unit thatgenerates a ciphertext c₂ by multiplying a message m by g_(T) ^(Δζ)obtained by a value g_(T)=e(b_(0,1), b*_(0,1)), the Δ, and the ζ,wherein the data transmission unit transmits to the decryption devicethe ciphertext ct including the ciphertext c₂ generated by theciphertext c2 generation unit and the ciphertext c₁, wherein the pairingoperation unit performs the pairing operation e (c₁, k*_(L,dec)) andcomputes a session key K:=g_(T) ^(Δζ), and wherein the decryption devicefurther includes a message computation unit that computes the message mby dividing the ciphertext c₂ by the session key K computed by thepairing operation unit.
 4. The cryptographic processing system of claim2, wherein the key generation device further includes a delegationelement generation unit that generates a delegation elementk*_(L,del,(τ,ι)) for an integer τ of τ=L+1 and each integer ι of ι=1, .. . , n_(τ), the delegation element generation unit generating thedelegation element k*_(L,del,(τ,ι)) by using a predetermined valueθ_(del,(τ,ι)) for each integer t of t=1, . . . , L, a predeterminedvalue ψ, and a predetermined value s_(del,(τ,ι),t) for each integer t oft=0, . . . , L+1 such that s_(del,(τ,ι),0)=Σ_(t=1)^(L+1)s_(del,(τ,ι),t), and by setting −s_(del,(τ,ι),0) as thecoefficient of the basis vector b*_(0,p) of the basis B*₀, settings_(del,(τ,ι),t)e{right arrow over ( )}_(t,1)+θ_(del,(τ,ι),t)v_(t,i)(i=1, . . . , n_(t)) as the coefficient of the basis vector b*_(t,i)(i=1, . . . , n_(t)) of the basis B*_(t) for each integer t of t=1, . .. , L, and setting s_(del,(τ,ι),L+1)e{right arrow over ()}_(τ,1)+ψe{right arrow over ( )}_(τ,ι) (i=1, . . . , n_(τ)) as acoefficient of a basis vector b*_(τ,i) (i=1, . . . , n_(τ)) of a basisB*_(τ), wherein the decryption key transmission unit transmits to thedelegation device the decryption key sk_(L) including the delegationelement k*_(L,del,(τ,ι)) generated by the delegation element generationunit and the decryption element k*_(L,dec), and wherein the keydelegation device includes a third information input unit that inputspredicate information v{right arrow over ( )}_(L+1):=(v_(L+1,i)) (i=1, .. . , n_(L+1)); a lower-level decryption element generation unit that,using the predicate information v{right arrow over ( )}_(L+1) input bythe third information input unit and the decryption key sk_(L)transmitted by the decryption key transmission unit, generates alower-level decryption element k*_(L+1,dec) including a vector shown inFormula 1; and a delegation key transmission unit that transmits to alower-level decryption device a lower-level decryption key sk_(L+1)including the lower-level decryption element k*_(L+1,dec) generated bythe lower-level decryption element generation unit.k* _(L,dec)+Σ_(i=1) ^(n) ^(L+1) v _(L+1,i) k* _(L,del,(L+1,i))  [Formula1]
 5. The cryptographic processing system of claim 4, wherein thecryptographic processing system performs the cryptographic process usingthe basis B₀ having at least a basis vector b_(0,i) (i=1, . . . , 1+n₀,1+n₀+1, . . . , 1+n₀+1+u₀, . . . , 1+n₀+1+u₀+w₀, . . . ,1+n₀+1+u₀+w₀+z₀) (n₀, u₀, w₀, and z₀ respectively being an integer of 1or more), the basis B*₀ having at least a basis vector b*_(0,i) (i=1, .. . , 1+n₀, 1+n₀+1, . . . , 1+n₀+1+u₀, . . . , 1+n₀+1+u₀+w₀, . . . ,1+n₀+1+u₀+w₀+z₀) (n₀, n₀, w₀, and z₀ respectively being an integer of 1or more), the basis B_(t) (t=1, . . . , L+1) having at least a basisvector b_(t,i) (i=1, . . . , n_(t), . . . , n_(t)+u_(t), . . . ,n_(t)+u_(t)+w_(t), . . . , n_(t)+u_(t)+w_(t)+z_(t)) (u_(t), w_(t), andz_(t) respectively being an integer of 1 or more), and the basis B*_(t)(t=1, . . . , L+1) having at least a basis vector b*_(t,i) (i=1, . . . ,n_(t), . . . , n_(t)+u_(t), . . . , n_(t)+u_(t)+w_(t), . . . ,n_(t)+u_(t)+w_(t)+z_(t)), wherein the decryption element generation unitgenerates the decryption element k*_(L,dec) as shown in Formula 2, basedon a random number η{right arrow over ( )}_(dec,t):=(η_(dec,t,i)) (i=1,. . . , w_(t)) for each integer t of t=0, . . . , L, and wherein theciphertext c1 generation unit generates the ciphertext c₁ as shown inFormula 3, based on a random number φ{right arrow over ()}_(t):=(φ_(t,i)) (i=1, . . . , z_(t)) for each integer t of t=0, . . ., L.K* _(L,dec):=((−s _(dec,0),0^(u) ⁰ ,Δ,{right arrow over(η)}_(dec,0),0^(z) ⁰ )B* ₀,(s _(dec,t) {right arrow over (e)}_(t,1)+θ_(dec,t) {right arrow over (v)} _(t),0^(u) ^(t) ,{right arrowover (η)}_(dec,t),0^(z) ^(t) )B* _(t) :t=1, . . . , L)  [Formula 2]c ₁:=((ω,0^(u) ⁰ ,ζ,0^(w) ⁰ ,{right arrow over (φ)}₀)B ₀θ(ω{right arrowover (x)} _(t),0^(u) ^(t) ,0^(w) ^(t) ,{right arrow over(φ)}_(t))Bt0:t=1, . . . , L)  [Formula 3]
 6. The cryptographicprocessing system of claim 5, wherein the key generation device furtherincludes a randomizing element generation unit that generates a firstrandomizing element k*_(L,ran,j) for each integer j of j=1, . . . , 2L,and generates a second randomizing element k*_(L,ran,(τ,ι)) for eachinteger τ of τ=L+1, . . . , d (d being an integer of L+1 or more) andeach integer t of t=1, . . . , n_(τ) with respect to each integer τ, therandomizing element generation unit generating the first randomizingelement k*_(L,ran,j) as shown in Formula 4, based on a predeterminedvalue θ_(ran,j,t) for each integer t of t=1, . . . , L, a predeterminedvalue s_(ran,j,t) for t=0, . . . , L such that s_(ran,j,0)=τ_(t=1)^(L)s_(ran,j,t), and a random number η{right arrow over ()}_(ran,j,t):=(η_(ran,j,t,i)) (i=1, . . . , w_(t)) for each integer t oft=0, . . . , L, and generating the second randomizing elementk*_(L,ran,(τ,ι)) as shown in Formula 5, based on a predetermined valueθ_(ran,(τ,ι),t) for each integer t of t=1, . . . , L, a predeterminedvalue s_(ran,(τ,ι),t):=for t=0, . . . , L+1 such thats_(ran,(τ,ι),0)=Σ_(t=1) ^(L+1)s_(ran,(τ,ι),t), and a random numberη{right arrow over ( )}_(ran,(τ,ι),t):=(η_(ran,(τ,ι),t,i)) (i=1, . . . ,w_(t)) (i=1, . . . , w_(t)) for each integer t of t=0, . . . , L+1,wherein the delegation element generation unit generates the delegationelement k*_(L,del,(τ,ι)) as shown in Formula 6 for each integer τ ofτ=L+1, . . . , d and each integer ι of ι=1, . . . , n_(τ) with respectto each integer τ, based on a random number η{right arrow over ()}_(del,(τ,ι),t):=(η_(del,(τ,ι),t,i)) (i=1, . . . , w_(t)) for eachinteger t of t=0, . . . , L+1, wherein the decryption key transmissionunit transmits to the delegation device the decryption key sk_(L)including the first randomizing element k*_(L,ran,j) and the secondrandomizing element k*_(L,ran,(τ,ι)) generated by the randomizingelement generation unit, the delegation element k*_(L,del(τ,ι))generated by the delegation element generation unit, and the decryptionelement k*_(L,dec), and wherein the lower-level decryption elementgeneration unit generates the lower-level decryption elementk*_(L+1,dec) as shown in Formula 7, using the predicate informationv{right arrow over ( )}_(L+1), the decryption key sk_(L) transmitted bythe decryption key transmission unit, a random number α_(dec,j) for eachinteger j of j=1, . . . , 2L, a random number σ_(dec), and a randomnumber η_(dec,(t,i)) for each integer t of t=0, . . . , L+1 and eachinteger i of i=1, . . . , w_(t). $\begin{matrix}{k_{L,{ran},j}^{*}:=\left( {\left( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} \right)_{B_{0}^{*}},{{\left( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} \right)_{B_{t}^{*}}:t} = 1},\ldots \mspace{14mu},L} \right)} & \left\lbrack {{Formula}\mspace{14mu} 4} \right\rbrack \\{k_{L,{ran},{({\tau,l})}}^{*}:=\left( {\left( {{- s_{{ran},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},{({\tau,l})},0},0^{z_{0}}} \right)_{B_{0}^{*}},{{\left( {{{s_{{ran},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},0^{z_{t}}} \right)_{B_{t}^{*}}:t} = 1},\ldots \mspace{14mu},{L\left( {{s_{{ran},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{ran},{{{({\tau,l})}L} + 1}},0^{z_{\tau}}} \right)}_{B_{\tau}^{*}}} \right)} & \left\lbrack {{Formula}\mspace{14mu} 5} \right\rbrack \\{k_{L,{del},{({\tau,l})}}^{*}:=\left( {\left( {{- s_{{del},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},{({\tau,l})},0},0^{z_{0}}} \right)_{B_{0}^{*}},{{\left( {{{s_{{del},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},{({\tau,l})},t},0^{z_{t}}} \right)_{B_{t}^{*}}:t} = 1}, \ldots \mspace{14mu},{L\left( {{{s_{{del},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}} + {\overset{->}{\psi e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},{({\tau,l})},{L + 1}},0^{z_{\tau}}} \right)}_{B_{\tau}^{*}}} \right)} & \left\lbrack {{Formula}\mspace{14mu} 6} \right\rbrack \\{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 7} \right\rbrack\end{matrix}$
 7. The cryptographic processing system of claim 6, whereinthe delegation device further includes a lower-level randomizing elementgeneration unit that generates a first lower-level randomizing elementk*_(L+1,ran,j′) for each integer j′ of j′=1, . . . , 2(L+1), andgenerates a second lower-level randomizing element k*_(L+1,ran,(τ,ι))for each integer τ of τ=L+2, . . . , d (d being an integer of L+2 ormore) and each integer ι of ι=1, . . . , n_(τ) with respect to eachinteger τ, the lower-level randomizing element generation unitgenerating the first lower-level randomizing element k*_(L+1,ran,j′) asshown in Formula 8, based on the predicate information v{right arrowover ( )}_(L+1), the decryption key sk_(L), a random number α_(ran,j′,j)for each integer j of j=1, . . . , 2L and each integer j′ of j′=1, . . ., 2(L+1), a random number σ_(ran,j)′ for each integer j′ of j′=1, . . ., 2(L+1), and a random number η_(ran,j′,(t,i)) for each integer t oft=0, . . . , L+1 and each integer i of i=1, . . . , w_(t), andgenerating the second lower-level randomizing element k*_(L+1,ran,(τ,ι))as shown in Formula 9, based on the predicate information v{right arrowover ( )}_(L+1), the decryption key sk_(L), a random numberα_(ran,(τ,ι),j) for each integer j of j=1, . . . , 2L, a random numberσ_(ran,(τ,ι)), a random number φ_(ran,(τ,ι)), and a random numberη_(ran,(τ,ι),(t,i)) for each integer t of t=0, . . . , L+1, τ and eachinteger i of i=1, . . . , w_(t); and a lower-level delegation elementgeneration unit that generates a lower-level delegation elementk*_(L+1,del,(τ,ι)) for each integer τ of τ=L+2, . . . , d (d being aninteger of L+2 or more) and each integer ι of ι=1, . . . , n_(τ) withrespect to each integer τ, the lower-level delegation element generationunit generating the lower-level delegation element k*_(L+1,del,(τ,ι)) asshown in Formula 10, based on the predicate informationv{right arrowover ( )}_(L+1), the decryption key sk_(L), a random numberα_(del,(τ,ι),j) for each integer j of j=1, . . . , 2L, a random numberσ_(del,(τ,ι)), a random number ψ′, a random number φ_(del,(τ,ι),) and arandom number η_(del,(τ,ι),(t,i)) for each integer t of t=0, . . . ,L+1, τ and each integer i of i=1, . . . , w_(t), and wherein thedelegation key transmission unit transmits to a lower-level delegationdevice a lower-level decryption key sk_(L+1) including the lower-leveldecryption element k*_(L+1,dec) generated by the lower-level decryptionelement generation unit, the first lower-level randomizing elementk*_(L+1,ran,j′) and the second lower-level randomizing elementk*_(L+1,ran,(τ,ι)) generated by the lower-level randomizing elementgeneration unit, and the lower-level delegation elementk*_(L+1,del,(τ,ι)) generated by the lower-level delegation elementgeneration unit. $\begin{matrix}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 8} \right\rbrack \\{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\varphi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \left\lbrack {{Formula}\mspace{14mu} 9} \right\rbrack \\{{k_{{L + 1},{del},{({\tau + l})}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{del},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} \right)} + {\psi^{\prime}k_{L,{del},{({\tau,l})}}^{*}} + {\varphi_{{del},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{del},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}{\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \left\lbrack {{Formula}\mspace{14mu} 10} \right\rbrack\end{matrix}$
 8. The cryptographic processing system of claim 2, whereinthe first information input unit inputs predicate information (v{rightarrow over ( )}_(t):=(v_(t,i))(i=1, . . . , n_(t)), ρ_(t)ε{0, 1}) foreach integer t of t=1, . . . , L, and wherein the decryption elementgeneration unit generates the decryption element k*_(L,dec) in which−s_(dec,0) is set as the coefficient of the basis vector b*_(0,p), the Δis set as the coefficient of the basis vector b*_(0,q), ands_(dec,t)e{right arrow over ( )}_(t+1)+θ_(dec,t)v_(t,i) (i=1, . . . ,n_(t)) when ρ_(t) is 0 or s_(dec,t)v_(t,i) (i=1, . . . , n_(t)) whenρ_(t) is 1 is set as the coefficient of the basis vector b*_(t,i) foreach integer t of t=1, . . . , L.
 9. The cryptographic processing systemof claim 8, wherein the key generation device further includes adelegation element generation unit that generates a first delegationelement k*_(L,del,(τ,ι,0)) and a second delegation elementk*_(L,del,(τ,ι,1)) for an integer τ of τ=L+1 and each integer ι of ι=1,. . . , n_(τ), the delegation element generation unit generating thefirst delegation element k*_(L,del,(τ,ι,0)) by using a predeterminedvalue θ_(del,0,t) for each integer t of t=1, . . . , L, a predeterminedvalue ψ, and a predetermined value s_(del,0,t) for t=0, . . . , L+1 suchthat s_(del,0,0)=Σ_(t=1) ^(L+1)s_(del,0,t), and by setting −s_(del,0,0)as the coefficient of the basis vector b*_(0,p) of the basis B*₀,setting s_(del,0,t)e{right arrow over ( )}_(t,1)+θ_(del,0,t)v_(t,i)(i=1, . . . , n_(t)) when ρ_(t) is 0 or s_(del,0,t)v_(t,i) (i=1, . . . ,n_(t)) when ρ_(t) is 1 as the coefficient of the basis vector b*_(t,i)(i=1, . . . , n_(t)) for each integer t of t=1, . . . , L, and settings_(del,0,L+1)e{right arrow over ( )}_(τ,1)+ψe{right arrow over ()}_(τ,ι) (i=1, . . . , n_(τ)) as a coefficient of a basis vectorb*_(τ,i) (i=1, . . . , n_(τ)) of a basis B*_(τ), and generating thesecond delegation element k*_(L,del,(τ,ι,1)) by using a predeterminedvalue θ_(del,1,t) for each integer t of t=1, . . . , L and apredetermined value s_(de1,1,t) for t=0, . . . , L+1 such thats_(del,1,0)=Σ_(t=1) ^(L+1)s_(del,1,t), and by setting −s_(del,1,0) asthe coefficient of the basis vector b*_(0,p) of the basis B*₀, settings_(del,1,t)e{right arrow over ( )}_(t,1)+θ_(del,1,t)v_(t,i) (i=1, . . ., n_(t)) when ρ_(t) is 0 or s_(del,1,t)v_(t,i) (i=1, . . . , n_(t)) whenρ_(t) is 1 as the coefficient of the basis vector b*_(t,i) (i=1, . . . ,n_(t)) of the basis B*_(t) for each integer t of t=1, . . . , L, andsetting s_(del,1,L+1)e{right arrow over ( )}_(τ,1) (i=1, . . . , n_(τ))as the coefficient of the basis vector b*_(τ,i) (i=1, . . . , n_(τ)) ofthe basis B*_(τ), wherein the decryption key transmission unit transmitsto the delegation device the decryption key sk_(L) including the firstdelegation element k*_(L,del,(τ,ι,0)) and the second delegation elementk*_(L,del,(τ,ι,1)) generated by the delegation element generation unitand the decryption element k*_(L,dec), and wherein the key delegationdevice includes a third information input unit that inputs predicateinformation (v{right arrow over ( )}_(L+1):=(v_(L+1,i))(i=1, . . . ,n_(L+1)), ρ_(L+1)ε{0, 1}); and a lower-level decryption elementgeneration unit that generates a lower-level decryption elementk*_(L+1,dec) including a vector shown in Formula 11, using the predicateinformation v{right arrow over ( )}_(L+1) input by the third informationinput unit and the decryption key sk_(L) transmitted by the decryptionkey transmission unit.                                     [Formula  11]$k_{L,{dec}}^{*} + \begin{Bmatrix}\left( {\sigma_{dec}\left( {\sum\limits_{t = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} \right. & {{{if}\mspace{14mu} \rho_{t}} = 0} \\\left( {\sigma_{dec}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} \right. & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix}$
 10. The cryptographic processing system of claim 9,wherein the cryptographic processing system performs the cryptographicprocess using the basis B₀ having at least a basis vector b_(0,i) (i=1,. . . , 1+n₀, 1+n₀+1, . . . , 1+n₀+1+u₀, . . . , 1+n₀+1+u₀+w₀, . . . ,1+n₀+1+u₀+w₀+z₀) (n₀, u₀, w₀, and z₀ respectively being an integer of 1or more), the basis B*₀ having at least a basis vector b*_(0,i) (i=1, .. . , 1+n₀, 1+n₀+1, . . . , 1+n₀+1+u₀, . . . , 1+n₀+1+u₀+w₀, . . . ,1+n₀+1+u₀+w₀+z₀) (n₀, u₀, w₀, and z₀ respectively being an integer of 1or more), the basis B_(t) (t=1, . . . , L+1) having at least a basisvector b_(t,i) (i=1, . . . , , n_(t), . . . , , n_(t)+u_(t), . . . ,n_(t)+u_(t)+w_(t), . . . , n_(t)+u_(t)+w_(t)+z_(t)) (u_(t), w_(t), andz_(t) respectively being an integer of 1 or more), and the basis B*_(t)(t=1, . . . , L+1) having at least a basis vector b*_(t,i) (i=1, . . . ,n_(t), . . . , n_(t)+u_(t), . . . , n_(t)+u_(t)+w_(t), . . . ,n_(t)+u_(t)+w_(t)+z_(t)), wherein the decryption element generation unitgenerates the decryption element k*_(L,dec) as shown in Formula 12,based on a random number η{right arrow over ( )}_(dec,t):=(η_(dec,t,i))(i=1, . . . , w_(t)) for each integer t of t=0, . . . , L, and whereinthe ciphertext c1 generation unit generates the ciphertext c₁ as shownin Formula 13, based on a random number φ{right arrow over ()}_(t):=(φ_(t,i)) (i=1, . . . , z_(t)) for each integer t of t=0, . . ., L.                                      [Formula  12]$k_{L,{dec}}^{*}:={\left( {\left( {{- s_{{dec},0}},0^{u_{0}},1,{\overset{->}{\eta}}_{{dec},0},0^{z_{0}}} \right)_{B_{0}^{*}},{{\begin{Bmatrix}{\left( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t,}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} \right)_{B_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{dec},t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} \right)_{B_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix}:t} = 1},\ldots \mspace{14mu},L} \right)\mspace{650mu}\left\lbrack {{Formula}\mspace{14mu} 13} \right\rbrack}$$c_{1}:=\left( {\left( {\omega,0^{u_{0}},\zeta,0^{w_{0}},{\overset{->}{\phi}}_{0}} \right)_{B_{0}0},{{\left( {{\omega \; {\overset{->}{x}}_{t}},0^{u_{t}},0^{w_{t}},{\overset{->}{\phi}}_{t}} \right)_{B_{t}0}:t} = 1},\ldots \mspace{14mu},L} \right)$11. The cryptographic processing system of claim 10, wherein the keygeneration device further includes a randomizing element generation unitthat generates a first randomizing element k*_(L,ran,j) for each integerj of j=1, . . . , 2L, and generates a second randomizing elementk*_(L,ran,(τ,ι,0)) for each integer τ of τ=L+1, . . . , d (d being aninteger of L+1 or more) and each integer ι of ι=1, . . . , n_(τ) withrespect to each integer τ, the randomizing element generation unitgenerating the first randomizing element k*_(L,ran,j) as shown inFormula 14, based on a predetermined value θ_(ran,j,t) for each integert of t=1, . . . , L, a predetermined value s_(ran,j,t) for t=0, . . . ,L such that s_(ran,j,0)=Σ_(t=1) ^(L)s_(ran,j,t), and a random numberη{right arrow over ( )}_(ran,j,t):=(η_(ran,j,t,i)) (i=1, . . . , w_(t))for each integer t of t=0, . . . , L, and generating the secondrandomizing element k*_(L,ran,(τ,ι,0)) as shown in Formula 15, based ona predetermined value θ_(ran,0,t) for each integer t of t=1, . . . , L,a predetermined value s_(ran,0,t) for t=0, . . . , L+1 such thats_(ran,0,0)=Σ_(t=1) ^(L+1)s_(ran,0,t), a random number η{right arrowover ( )}_(ran,0,t):=(η_(ran,0,t,i)) (i=1, . . . , w_(t)) for eachinteger t of t=0, . . . , L, and a random number η{right arrow over ()}_(ran,0,(τ,ι)):=(η_(ran,0,(τ,ι),i)) (i=1, . . . , w_(t)), wherein thedelegation element generation unit generates the first delegationelement k*_(L,del,(τ,ι,0)) as shown in Formula 16 for each integer τ ofτ=L+1, . . . , d and each integer ι of ι=1, . . . ,n_(τ with respect to each integer τ, based on a random number η{right arrow over ( )})_(del,0,t):=(η_(del,0,t,i)) (i=1, . . . , w_(t)) for each integer t oft=0, . . . , L and a random number η{right arrow over ()}_(del,0,(τ,ι)):=(η_(del,0,(τ,ι),i)) (i=1, . . . , w_(t)), andgenerates the second delegation element k*_(L,del,(τ,ι,1)) as shown inFormula 17 for each integer τ of τ=L+1, . . . , d and each integer ι ofι=1, . . . , n_(τ) with respect to each integer τ, based on a randomnumber η{right arrow over ( )}_(del,1,t):=(η_(del,1,t,i)) (i=1, . . . ,w_(t)) for each integer t of t=0, . . . , L and a random number η{rightarrow over ( )}_(del,1,(τ,ι)):=(η_(del,1,(τ,ι),i)) (i=1, . . . , w_(t)),wherein the decryption key transmission unit transmits to the delegationdevice the decryption key sk_(L) including the first randomizing elementk*_(L,ran,j) and the second randomizing element k*_(L,ran,(τ,ι,0))generated by the randomizing element generation unit, the firstdelegation element k*_(L,del,(τ,ι,0)) and the second delegation elementk*_(L,del,(τ,ι,1)) generated by the delegation element generation unit,and the decryption element k*_(L,dec), and wherein the lower-leveldecryption element generation unit generates the lower-level decryptionelement k*_(L+1,dec) as shown in Formula 18, using the predicateinformation v{right arrow over ( )}_(L+1), the decryption key sk_(L)transmitted by the decryption key transmission unit, a random numberα_(dec,j) for each integer j of j=1, . . . , 2L, a random numberσ_(dec), and a random number η_(dec,(t,i)) for each integer t of t=0, .. . , L+1 and each integer i of i=1, . . . , w_(t). $\begin{matrix}{\mspace{79mu} {k_{L,{ran},j}^{*}:=\left( {\left( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} \right)_{B_{0}^{*}},{{\begin{Bmatrix}{\left( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} \right)_{B_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{ran},j,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} \right)_{B_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix}:t} = 1},\ldots \mspace{14mu},L} \right)}} & \left\lbrack {{Formula}\mspace{14mu} 14} \right\rbrack \\\left. \mspace{79mu} {{k_{L,{ran},{({\tau,l,0})}}^{*}:=\left( {\left( {{- s_{{ran},0,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},0,0},0^{z_{0}}} \right)_{B_{0}^{*}},{{\left\{ \begin{matrix}{\left( {{{s_{{ran},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},0,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},0,t},0^{z_{t}}} \right)_{B_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{ran},0,t}\overset{->}{v}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},0,t},0^{z_{t}}} \right)_{B_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{matrix} \right\} :t} = 1},\ldots \mspace{14mu},L} \right)},\mspace{20mu} \left( {{s_{{ran},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}},0^{z_{\tau}}} \right)_{B_{\tau}^{*}}} \right) & \left\lbrack {{Formula}\mspace{14mu} 15} \right\rbrack \\\left. \mspace{79mu} {{k_{L,{del},{({\tau,l,0})}}^{*}:=\left( {\left( {{- s_{{del},0,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},0,0},0^{z_{0}}} \right)_{B_{0}^{*}},{{\left\{ \begin{matrix}{\left( {{{s_{{del},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},0,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},0,t},0^{z_{t}}} \right)_{B_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{del},0,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{del},0,t},0^{z_{t}}} \right)_{B_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{matrix} \right\} :t} = 1},\ldots \mspace{14mu},L} \right)},\mspace{20mu} \left( {{s_{{del},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},{{+ \psi}{\overset{->}{e}}_{\tau,l}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},0,{({\tau,l})}},0^{z_{r}}} \right)_{B_{\tau}^{*}}} \right) & \left\lbrack {{Formula}\mspace{14mu} 16} \right\rbrack \\\left. \mspace{79mu} {{k_{{L + 1},{del},{({\tau,l,1})}}^{*}:=\left( {\left( {{- s_{{del},1,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},1,0},0^{z_{0}}} \right)_{B_{0}^{*}},{{\begin{Bmatrix}{\left( {{{s_{{del},1,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},1,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},1,t},0^{z_{t}}} \right)_{B_{t}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\left( {{s_{{del},1,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{del},1,t},0^{z_{t}}} \right)_{B_{i}^{*}},} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix}:t} = 1},\ldots \mspace{14mu},L} \right)},\mspace{20mu} \left( {{s_{{del},1,{L + 1}}{\overset{->}{e}}_{\tau,l}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},1,{({\tau,l})}},0^{z_{\tau}}} \right)_{B_{\tau}^{*}}} \right) & \left\lbrack {{Formula}\mspace{14mu} 17} \right\rbrack \\{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}\left( {\sigma_{dec}\left( {\sum\limits_{j = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} \right. & {{{if}\mspace{14mu} \rho_{t}} = 0} \\\left( {\sigma_{dec}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} \right. & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 18} \right\rbrack\end{matrix}$
 12. The cryptographic processing system of claim 11,wherein the delegation device further includes a lower-level randomizingelement generation unit that generates a first lower-level randomizingelement k*_(L+1,ran,j′) for each integer j′ of j′=1, . . . , 2(L+1), andgenerates a second lower-level randomizing element k*_(L+1,ran,(τ,ι,0))for each integer τ of τ=L+2, . . . , d (d being an integer of L+2 ormore) and each integer ι of ι=1, . . . , n_(τ) with respect to eachinteger τ, the lower-level randomizing element generation unitgenerating the first lower-level randomizing element k*_(L+1,ran,j′) asshown in Formula 19, based on the predicate information v{right arrowover ( )}_(L+1), the decryption key sk_(L), a random number α_(ran,j′,j)for each integer j of j=1, . . . , 2L and each integer j′ of j′=1, . . ., 2(L+1), a random number σ_(ran,j′) for each integer j′ of j′=1, . . ., 2(L+1), and a random number η_(ran,j′,(t,i)) for each integer t oft=0, . . . , L+1 and each integer i of i=1, . . . , w_(t), andgenerating the second lower-level randomizing elementk*_(L+1,ran,(τ,ι,0)) as shown in Formula 20, based on the predicateinformation v{right arrow over ( )}_(L+1), the decryption key sk_(L), arandom number α_(ran,(τ,ι),j) for each integer j of j=1, . . . , 2L, arandom number σ_(ran,(τ,ι,0)), a random number φ_(ran,(τ,ι,0)), andη_(ran,(τ,ι,0),(t,i)) for each integer t of t=0, L+1 and each integer iof i=1, . . . , w_(t); and a lower-level delegation element generationunit that generates a first lower-level delegation elementk*_(L+1,del,(τ,ι,0)) and a second lower-level delegation elementk*_(L+1,del,(τ,ι,1)) for each integer τ of τ=L+2, . . . , d (d being aninteger or L+2 or more) and each integer ι of ι=1, . . . , n_(τ) withrespect to each integer τ, the lower-level delegation element generationunit generating the first lower-level delegation elementk*_(L+1,del,(τ,ι,0)) as shown in Formula 21, based on the predicateinformation v{right arrow over ( )}_(L+1), the decryption key sk_(L), arandom number α_(del,(τ,ι,0),j) for each integer j of j=1, . . . , 2L, arandom number σ_(del,(τ,ι,0)), a random number ψ₀, a random numberφ_(del,(τ,ι,0)), and η_(del,(τ,ι,0),(t,i)) for each integer t of t=0, .. . , L+1 and each integer i of i=1, . . . , w_(t), and generating thesecond lower-level delegation element k*_(L+1,del,(τ,ι,1)) as shown inFormula 22, based on the predicate information v{right arrow over ()}_(L+1), the decryption key sk_(L), a random number α_(del,(τ,ι,1),j)for each integer j of j=1, . . . , 2L, and a random numberσ_(del,(τ,ι,1)), a random number ψ₁, a random number φ_(del,(τ,ι,1)),and η_(del,(τ,ι,1),(t,i)) for each integer t of t=0, . . . , L+1 andeach integer i of i=1, . . . , w_(t). $\begin{matrix}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}{\sigma_{{ran},j^{\prime}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{ran},j^{\prime}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \left\lbrack {{Formula}\mspace{14mu} 19} \right\rbrack \\{k_{{L + 1},{{ran}{({\tau,l,0})}}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{ran},{{({\tau,l})}j},}k_{L,{ran},j}^{*}}} + {\varphi_{{ran},{({\tau,l,0})}}k_{L,{ran},{({\tau,l,0})}}^{*}} + \begin{Bmatrix}{\sigma_{ran},_{({\tau,l,0})}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{ran},_{({\tau,l,0})}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{i = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \left\lbrack {{Formula}\mspace{14mu} 20} \right\rbrack \\{k_{{L + 1},{{del}{({\tau,l,0})}}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{del},{({\tau,l,0})},j}k_{L,{ran},j}^{*}}} + {\varphi_{{del},{({\tau,l,0})}}k_{L,{{ran}{({\tau,l,0})}}}^{*}} + {\psi_{0}k_{L,{{del}{({\tau,l,0})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,0})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,0})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \left\lbrack {{Formula}\mspace{14mu} 21} \right\rbrack \\{k_{{L + 1},{{del}{({\tau,l,1})}}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{{del}{({\tau,l,1})}},j}k_{L,{ran},j}^{*}}} + {\psi_{1}k_{L,{{del}{({\tau,l,1})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,1})}}\left( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,1})}}\left( {\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\left\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \right\rbrack}_{L}}} \right)} & {{{if}\mspace{14mu} \rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,1})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,1})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,1})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \left\lbrack {{Formula}\mspace{14mu} 22} \right\rbrack\end{matrix}$
 13. A key generation device that generates a decryptionkey sk_(L) in a cryptographic processing system that performs acryptographic process using a basis B_(t) and a basis B*_(t) for eachinteger t of t=1, . . . , L (L being an integer of 1 or more), the keygeneration device comprising: a first information input unit that inputspredicate information v{right arrow over ( )}_(t):=(v_(t,i)) (i=1, . . ., n_(t)) for each integer t of t=1, . . . , L; a decryption elementgeneration unit that, using the predicate information v{right arrow over( )}_(t) input by the first information input unit, a predeterminedvalue Δ, a predetermined value θ_(dec,t) for each integer t of t=1, . .. , L, and a predetermined value s_(dec,t) for each integer t of t=0, .. . , L such that s_(dec,0)=Σ_(t=1) ^(L)s_(dec,t), generates adecryption element k*_(L,dec) in which −s_(dec,0) is set as acoefficient of a basis vector b*_(0,p) (p being a predetermined value)of a basis B*₀, the Δ is set as a coefficient of a basis vector b*_(0,q)(q being a predetermined value) of the basis B*₀, and s_(dec,t)e{rightarrow over ( )}_(t,1)+θ_(dec,t)v_(t,i) (i=1, . . . , n_(t)) is set as acoefficient of a basis vector b*_(t,i) (i=1, . . . , n_(t)) of the basisB*_(t) for each integer t of t=1, . . . , L; and a decryption keytransmission unit that transmits to a decryption device the decryptionkey sk_(L) including the decryption element k*_(L,dec) generated by thedecryption element generation unit.
 14. An encryption device thatgenerates a ciphertext ct in a cryptographic processing system thatperforms a cryptographic process using a basis B_(t) and a basis B*_(t)for each integer t of t=1, . . . , L (L being an integer of 1 or more),the encryption device comprising: a second information input unit thatinputs attribute information x{right arrow over ( )}_(t):=(x_(t,i))(i=1, . . . , n_(t)) for at least some integer t of t=1, . . . , L; aciphertext c1 generation unit that, using the attribute informationx{right arrow over ( )}_(t) input by the second information input unitand predetermined values ω and ζ, generates a ciphertext c₁ in which theω is set as a coefficient of a basis vector b_(0,p) (p being apredetermined value) of a basis B₀, the ζ is set as a coefficient of abasis vector b_(0,q) (q being a predetermined value) of the basis B₀,and ωx_(t,i) (i=1, . . . , n_(t)) is set as a coefficient of a basisvector b_(t,i) (i=1, . . . , n_(t)) of the basis B_(t) for the at leastsome integer t; and a data transmission unit that transmits to adecryption device the ciphertext ct including the ciphertext c₁generated by the ciphertext c1 generation unit.
 15. A decryption devicethat decrypt a ciphertext c₁ by a decryption key sk_(L) in acryptographic processing system that performs a cryptographic processusing a basis B_(t) and a basis B*_(t) for each integer t of t=1, . . ., L (L being an integer of 1 or more), the decryption device comprising:a data receiving unit that receives from an encryption device theciphertext c₁ in which, using attribute information x{right arrow over ()}_(t):=(x_(t,i) (i=)1, . . . , n_(t)) and predetermined values ω and ζ,the ω is set as a coefficient of a basis vector b_(0,p) (p being apredetermined value) of a basis B₀, the ζ is set as a coefficient of abasis vector b_(0,q) (q being a predetermined value) of the basis B₀,and ωx_(t,i) (i=1, . . . , n_(t)) is set as a coefficient of a basisvector b_(t,i) (i=1, . . . , n_(t)) of the basis B_(t) for at least someinteger t; a decryption key acquisition unit that obtains from a keygeneration device the decryption key sk_(L) including a decryptionelement k*_(L,dec) in which, using predicate information v{right arrowover ( )}_(t):=(v_(t,i)) (i=1, . . . , n_(t)), a predetermined value Δ,a predetermined value θ_(dec,t) for each integer t of t=1, . . . , L,anda predetermined value s_(dec,t) for each integer t of t=0, . . . , Lsuch that s_(dec,0)=Σ_(t=1) ^(L)s_(dec,t),−s_(dec,0) is set as acoefficient of a basis vector b*_(0,p) (p being a predetermined value)of a basis B*₀, the Δ is set as a coefficient of a basis vector b*_(0,q)(q being a predetermined value) of the basis B*₀, and s_(dec,t)e{rightarrow over ( )}_(t,1)+θ_(dec,t)v_(t,i) (i=1, . . . , n_(t)) is set as acoefficient of a basis vector b*_(t,i) (i=1, . . . , n_(t)) of the basisB*_(t) for each integer t of t=1, . . . , L; and a pairing operationunit that performs a pairing operation e (c₁, k*_(L,dec)) on theciphertext c₁ received by the data receiving unit and the decryptionelement k*_(L,dec) included in the decryption key k obtained by thedecryption key acquisition unit, and decrypts the ciphertext c₁.
 16. Akey delegation device that generates a lower-level decryption keysk_(L+1) of a decryption key sk_(L) in a cryptographic processing systemthat performs a cryptographic process using a basis B_(t) and a basisB*_(t) for each integer t of t=1, . . . , L+1 (L being an integer of 1or more), the key delegation device comprising: a decryption keyacquisition unit that obtains, as the decryption key sk_(L), a vector inwhich predicate information v{right arrow over ( )}_(t) is embedded in abasis vector of the basis B*_(t) for each integer t of t=1, . . . , L;and a delegation key generation unit that generates the lower-leveldecryption key sk_(L+1) of the decryption key sk_(L), based on thedecryption key sk_(L) obtained by the decryption key acquisition unitand a vector in which predicate information v{right arrow over ()}_(L+1) is embedded in a basis vector of a basis B*_(L+1).
 17. Acryptographic processing method using a basis B_(t) and a basis B*_(t)for each integer t of t=1, . . . , L+1 (L being an integer of 1 ormore), the cryptographic processing method comprising: an encryptionprocess by an encryption device of generating, as a ciphertext ct, avector in which attribute information x{right arrow over ( )}_(t) isembedded in a basis vector of the basis B_(t) for at least some integert of t=1, . . . , L; a decryption process by a decryption device ofusing, as a decryption key sk_(L), a vector in which predicateinformation v{right arrow over ( )}_(t) is embedded in a basis vector ofthe basis B*_(t) for each integer t of t=1, . . . , L, performing apairing operation on the ciphertext ct generated in the encryptionprocess and the decryption key sk_(L), and decrypting the ciphertext ct;and a key delegation process by a key delegation device of generating alower-level decryption key sk_(L+1) of the decryption key sk_(L), basedon a vector v{right arrow over ( )}_(L+1) in which predicate informationis embedded in a basis vector of a basis B*_(L+1) and the decryption keysk_(L) used in the decryption process.
 18. A cryptographic processingprogram that executes a cryptographic process using a basis B_(t) and abasis B*_(t) for each integer t of t=1, . . . , L+1 (L being an integerof 1 or more), the cryptographic processing program comprising: anencryption process of generating, as a ciphertext ct, a vector in whichattribute information x{right arrow over ( )}_(t) is embedded in a basisvector of the basis B_(t) for at least some integer t of t=1, . . . , L;a decryption process of using, as a decryption key sk_(L), a vector inwhich predicate information v{right arrow over ( )}_(t) is embedded in abasis vector of the basis B*_(t) for each integer t of t=1, . . . , L,performing a pairing operation on the ciphertext ct generated by theencryption process and the decryption key sk_(L), and decrypting theciphertext ct; and a key delegation process of generating a lower-leveldecryption key sk_(L+1) of the decryption key sk_(L), based on a vectorv{right arrow over ( )}_(L+1) in which predicate information is embeddedin a basis vector of a basis B*_(L+1) and the decryption key sk_(L) usedin the decryption process.